CGRC · Question #23
Which of the following are the common roles with regard to data in an information classification program? Each correct answer represents a complete solution. Choose all that apply. Response:
The correct answer is A. Custodian B. User C. Security auditor E. Owner. Common roles in an information classification program include the Owner, who is ultimately responsible for the data; the Custodian, who manages data access and protection; the User, who accesses and utilizes the data; and the Security Auditor, who verifies compliance.
Question
Which of the following are the common roles with regard to data in an information classification program? Each correct answer represents a complete solution. Choose all that apply. Response:
Options
- ACustodian
- BUser
- CSecurity auditor
- DEditor
- EOwner
How the community answered
(25 responses)- A88% (22)
- D12% (3)
Why each option
Common roles in an information classification program include the Owner, who is ultimately responsible for the data; the Custodian, who manages data access and protection; the User, who accesses and utilizes the data; and the Security Auditor, who verifies compliance.
The Custodian is responsible for the day-to-day management and protection of data, implementing the security controls defined by the owner.
The User is any individual who accesses, processes, or uses information within the system, adhering to established security policies.
The Security auditor reviews and assesses the security controls and policies to ensure compliance and identify vulnerabilities in the information classification program.
Editor is a general role related to content creation or modification, but not a standard, distinct role in information classification programs regarding data responsibility or oversight.
The Owner, often a business unit or department head, has ultimate responsibility for the data, including its classification, protection, and usage policies.
Concept tested: Information classification roles
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-100.pdf
Topics
Community Discussion
No community discussion yet for this question.