Problem Statement
What is a key first step in assessing cloud security risk for a new workload?
Explanation
Before implementing controls, you must understand what you are protecting. That means classifying the data (sensitivity, regulatory status) and mapping how it moves into, around, and out of the cloud workload. Without this you cannot determine where the risks are, which controls apply, or how the NIST Cybersecurity Framework core functions (Identify, Protect, Detect, Respond, Recover) apply. :contentReference[oaicite:1]{index=1}
