nerdexam
(ISC)2

CGRC · Question #374

Who is primarily responsible for categorizing the Information System? Response:

The correct answer is C. Information system owner. The Information System Owner holds primary responsibility for categorizing an information system based on its mission, business functions, and the criticality of the data it handles.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Who is primarily responsible for categorizing the Information System? Response:

Options

  • AIS program manager
  • BCIO
  • CInformation system owner
  • DSystem architect

How the community answered

(38 responses)
  • B
    5% (2)
  • C
    92% (35)
  • D
    3% (1)

Why each option

The Information System Owner holds primary responsibility for categorizing an information system based on its mission, business functions, and the criticality of the data it handles.

AIS program manager

An IS program manager oversees multiple systems or initiatives, but the direct responsibility for categorizing a specific information system falls to its owner.

BCIO

The CIO has overall enterprise-level responsibility for information and technology, but delegates system-specific responsibilities, including categorization, to individual system owners.

CInformation system ownerCorrect

The Information System Owner is formally responsible for the information system's categorization, ensuring that security controls are appropriate to the system's mission, business requirements, and the sensitivity of the information it processes, as defined by standards like FIPS 199.

DSystem architect

A system architect designs the technical components of a system, but the business and mission impact assessment for categorization is the responsibility of the system owner.

Concept tested: Roles and responsibilities in information system security

Source: https://csrc.nist.gov/glossary/term/information-system-owner

Topics

#Information System Owner#Roles and Responsibilities#System Categorization#CGRC Fundamentals

Community Discussion

No community discussion yet for this question.

Full CGRC Practice