A company must choose security controls for data with different sensitivity and retention requirements. What should come first?

1. Give every dataset identical public-read access before reviewing its purpose.
2. Assume every copied dataset has no remaining owner.
3. Choose the cheapest storage class as the sole security criterion.
4. Identify and classify the data, its owners, applicable requirements, and lifecycle.