nerdexam
(ISC)2

CGRC · Question #247

Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian? Response:

The correct answer is C. The data custodian implements the information classification scheme after the initial assignment. The data owner is responsible for the initial classification of data, while the data custodian is responsible for implementing and maintaining the security controls and policies to protect that data based on its classification. The data custodian acts on the data owner's behalf…

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian? Response:

Options

  • AThe data owner implements the information classification scheme after the initial assignment by
  • BThe custodian implements the information classification scheme after the initial assignment by the
  • CThe data custodian implements the information classification scheme after the initial assignment
  • DThe custodian makes the initial information classification assignments and the operations manager

How the community answered

(37 responses)
  • A
    5% (2)
  • B
    3% (1)
  • C
    89% (33)
  • D
    3% (1)

Why each option

The data owner is responsible for the initial classification of data, while the data custodian is responsible for implementing and maintaining the security controls and policies to protect that data based on its classification. The data custodian acts on the data owner's behalf to ensure data protection.

AThe data owner implements the information classification scheme after the initial assignment by

This statement incorrectly assigns the implementation role to the data owner and omits the custodian's primary implementation responsibility.

BThe custodian implements the information classification scheme after the initial assignment by the

This choice is incomplete and slightly awkward in phrasing, but it's attempting to convey similar information to C. However, C is clearer and more direct in contrasting their roles.

CThe data custodian implements the information classification scheme after the initial assignmentCorrect

The data owner (or information owner) is typically a high-level manager or executive who is ultimately accountable for the protection of specific data, including making decisions about its classification, sensitivity, and usage. The data custodian (or information custodian) is responsible for the day-to-day management and protection of the data, implementing the security controls and policies (including the information classification scheme) that the data owner has mandated.

DThe custodian makes the initial information classification assignments and the operations manager

This statement incorrectly places the initial classification assignment with the custodian; classification is a responsibility of the data owner.

Concept tested: Roles of data owner and data custodian

Source: https://www.microsoft.com/en-us/microsoft-365/blog/2021/04/06/understanding-data-governance-roles-and-responsibilities/

Topics

#Data Owner#Data Custodian#Information Classification#Roles and Responsibilities

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice