CGRC · Question #374
Who is primarily responsible for categorizing the Information System? Response:
The correct answer is C. Information system owner. The Information System Owner holds primary responsibility for categorizing an information system based on its mission, business functions, and the criticality of the data it handles.
Question
Who is primarily responsible for categorizing the Information System? Response:
Options
- AIS program manager
- BCIO
- CInformation system owner
- DSystem architect
How the community answered
(38 responses)- B5% (2)
- C92% (35)
- D3% (1)
Why each option
The Information System Owner holds primary responsibility for categorizing an information system based on its mission, business functions, and the criticality of the data it handles.
An IS program manager oversees multiple systems or initiatives, but the direct responsibility for categorizing a specific information system falls to its owner.
The CIO has overall enterprise-level responsibility for information and technology, but delegates system-specific responsibilities, including categorization, to individual system owners.
The Information System Owner is formally responsible for the information system's categorization, ensuring that security controls are appropriate to the system's mission, business requirements, and the sensitivity of the information it processes, as defined by standards like FIPS 199.
A system architect designs the technical components of a system, but the business and mission impact assessment for categorization is the responsibility of the system owner.
Concept tested: Roles and responsibilities in information system security
Source: https://csrc.nist.gov/glossary/term/information-system-owner
Topics
Community Discussion
No community discussion yet for this question.