$8.$ What determines the assignment of data classifications in a mandatory access control $($MAC$)$ philosophy?

A$.$ The analysis of the users in conjunction with the audit department

B$.$ The assessment by the information security department

C$.$ The user$$s evaluation of a particular information element

D$.$ The organization$$s published security policy for data classification