Question

A multinational manufacturer is establishing a formal data governance program after an audit found that no one could authoritatively decide who may approve access to sensitive engineering design files. The CISO wants to assign accountability for the business value, classification level, and acceptable use of these datasets, while separating that responsibility from the team that manages storage, backups, and technical access controls. Which role assignment best satisfies this requirement?

Accepted Answer

Designate a data owner accountable for classification and access decisions, and a data custodian responsible for implementing technical controls

Answer

Assign the storage administration team as both data owner and custodian to streamline access approvals

Answer

Make the Data Protection Officer the data owner for all engineering datasets and delegate classification to end users

Answer

Designate a data processor to define classification and a data controller to implement backups and encryption