An enterprise incurred penalties for noncompliance with privacy regulations. Which of the following is MOST important to ensure appropriate ownership of access controls to address this deficiency?

Implementing access controls based on roles or business rules ensures that individuals are granted access commensurate with their job function and the principle of least privilege, thereby defining the 'owner' of that access entitlement. This systematic approach directly links access privileges to specific organizational functions, which is crucial for demonstrating compliance with privacy regulations by limiting access to personal data to only those who require it for legitimate business purposes.

Implementing multi-factor authentication enhances the strength of authentication but does not inherently address the ownership or appropriateness of what a user can access once authenticated.

Granting access based on information architecture describes how data is structured, but it doesn't establish the ownership or business justification for who should have access.

Engaging an audit is a verification step to assess existing controls and policies, but it's not the primary action to establish appropriate ownership of access controls in the first place.