CISM · Question #84
Of the following, who should own the risk associated with unauthorized access to application data?
The correct answer is C. Application owner. The application owner should own the risk associated with unauthorized access to application data, as they are ultimately accountable for the business processes and information managed by that application.
Question
Of the following, who should own the risk associated with unauthorized access to application data?
Options
- AData custodian
- BApplication developer
- CApplication owner
- DAccess administrator
How the community answered
(26 responses)- A8% (2)
- C88% (23)
- D4% (1)
Why each option
The application owner should own the risk associated with unauthorized access to application data, as they are ultimately accountable for the business processes and information managed by that application.
A data custodian (e.g., IT department) implements and manages the controls to protect the data, but they do not *own* the business risk.
An application developer creates and maintains the application, but they are not typically responsible for the business risk associated with its data or operation.
The application owner is typically a business stakeholder who is accountable for the data processed by the application, its functionality, and the business outcomes it supports. Therefore, they are ultimately responsible for understanding and accepting the risks associated with the application, including the risk of unauthorized access to its data, and for ensuring appropriate controls are in place.
An access administrator manages user permissions and access controls, which is an operational role in risk mitigation, not risk ownership.
Concept tested: Data/Application risk ownership
Source: https://learn.microsoft.com/en-us/compliance/regulatory/auditing-security-and-governance
Topics
Community Discussion
No community discussion yet for this question.