Which of the following is the information owner responsible for?

Developing policies, standards, and baselines is the responsibility of senior management or the CISO, not the information owner.

The information owner (also called data owner) holds business responsibility for the data and is the authoritative party for determining its classification level - such as confidential, internal, or public. This classification then drives the security controls applied by custodians. No other role has the contextual business knowledge to make this determination.

Integrating security considerations into purchasing decisions falls under the security architect or CISO role, not the information owner.

Implementing and evaluating security controls is the responsibility of the data custodian or security administrator, not the information owner.