For the e-z-buy mobile application, explain why the team should identify data flows and assets before selecting security controls.

### Why this is right The application depends on sensitive information and connected systems. Without knowing what assets exist and where data moves, the team cannot reliably identify exposure points or select controls that address the relevant risks. ### The concept Asset identification establishes the value and importance of information, systems, and components. Data-flow analysis then follows information through the mobile application, corporate network, and backend database. That view can reveal places where data might be exposed or where service might be disrupted. Controls should respond to the risks found and support the stated requirement for continuous availability. ### What a good answer covers - Identify sensitive information and the application’s supporting systems. - Explain that data flows reveal possible attack points. - Connect control selection to identified threats and vulnerabilities. - Recognize that availability is also a requirement for this application. ### Terms - **Backend database**: a database used behind an application to store or retrieve information. - **Data flow**: the path information takes through a system. ### Remember Map the assets and information paths before deciding which safeguards fit.