An organization has implemented a new email filter to mitigate risk associated with its email system. Who is BEST suited to be the control owner?

The Head of the IT department might be responsible for the *operation* of the email filter, but the *ownership* of the security control itself typically rests with information security.

The Head of compliance ensures adherence to regulations but is not typically the owner of specific technical security controls.

The Head of corporate communications uses the email system but is not responsible for its underlying security controls.

The Head of information security is responsible for managing and overseeing the organization's information security program, including the implementation and effectiveness of security controls like an email filter. As the control owner, this individual is accountable for ensuring the filter adequately mitigates email-related risks and aligns with the organization's security policies.