CAS-003 · Question #337
Engineers at a company believe a certain type of data should be protected from competitors, but the data owner insists the information is not sensitive. An information security engineer is…
The correct answer is C. Label the data as non-sensitive. In data governance frameworks, the data owner holds the authority and accountability for classifying data. Even when other stakeholders disagree, the data owner's determination is authoritative. Since the data owner explicitly states the information is not sensitive, the…
Question
Engineers at a company believe a certain type of data should be protected from competitors, but the data owner insists the information is not sensitive. An information security engineer is implementing controls to secure the corporate SAN. The controls require dividing data into four groups: non-sensitive, sensitive but accessible, sensitive but export-controlled, and extremely sensitive. Which of the following actions should the engineer take regarding the data?
Options
- ALabel the data as extremely sensitive.
- BLabel the data as sensitive but accessible.
- CLabel the data as non-sensitive.
- DLabel the data as sensitive but export-controlled.
How the community answered
(21 responses)- A5% (1)
- B10% (2)
- C81% (17)
- D5% (1)
Explanation
In data governance frameworks, the data owner holds the authority and accountability for classifying data. Even when other stakeholders disagree, the data owner's determination is authoritative. Since the data owner explicitly states the information is not sensitive, the engineer must honor that classification and label it non-sensitive. Overriding the data owner without a formal escalation or policy exception would violate established data governance principles. The engineers' concerns should be raised through proper channels rather than unilaterally applied.
Topics
Community Discussion
No community discussion yet for this question.