Which of the following roles is PRIMARILY responsible for asset classification?

The correct answer is B. Asset owner. Asset classification is a business decision, not a technical one. The asset owner - the individual or department accountable for the asset - understands its business value, sensitivity, regulatory requirements, and criticality better than anyone else. They are therefore best posi

Submitted by fernanda_arg· Apr 18, 2026Information Security Governance

Question

Options

AInformation security manager
BAsset owner
COperations manager
DAsset custodian

How the community answered

(40 responses)

A
5% (2)
B
88% (35)
C
5% (2)
D
3% (1)

Explanation

Asset classification is a business decision, not a technical one. The asset owner - the individual or department accountable for the asset - understands its business value, sensitivity, regulatory requirements, and criticality better than anyone else. They are therefore best positioned to assign the correct classification label (e.g., confidential, public, restricted). The information security manager (A) develops classification policies and frameworks. The operations manager (C) handles day-to-day operational matters. The asset custodian (D) implements and enforces the controls the owner prescribes, but has no authority to classify. Accountability for classification rests with the owner.

Topics

#Asset classification#Roles and responsibilities#Asset ownership#Information asset management

Community Discussion

No community discussion yet for this question.

Full CISM Practice