An organization's main product is a customer-facing application delivered using Software as a Service (SaaS). The lead security engineer has just identified a major security vulnerability at the…

The correct answer is D. The data owner. The data owner is primarily accountable for the risk associated with a security vulnerability in a SaaS application, as they are responsible for ensuring the protection of data and making decisions regarding risk acceptance, mitigation, or transfer. While the security manager…

Submitted by hassan_iq· Apr 18, 2026Information Security Governance

Question

An organization's main product is a customer-facing application delivered using Software as a Service (SaaS). The lead security engineer has just identified a major security vulnerability at the primary cloud provider. Within the organization, who is PRIMARILY accountable for the associated risk?

Options

AThe information security manager
BThe data custodian
CThe supplier relationship owner
DThe data owner

How the community answered

(64 responses)

A
3% (2)
B
6% (4)
C
11% (7)
D
80% (51)

Explanation

The data owner is primarily accountable for the risk associated with a security vulnerability in a SaaS application, as they are responsible for ensuring the protection of data and making decisions regarding risk acceptance, mitigation, or transfer. While the security manager provides guidance, the supplier relationship owner manages contracts, and the data custodian enforces controls, ultimate accountability lies with the data owner, who determines the level of acceptable risk and necessary security measures.

Topics

#Risk accountability#Data ownership#Cloud security governance#Roles and responsibilities

Community Discussion

No community discussion yet for this question.

Full CISM Practice