What MUST each information owner do when a system contains data from multiple information owners?

Each information owner is responsible for understanding the sensitivity and security requirements of their own data. When data from multiple owners resides on a shared system, each owner must provide input to the IS owner so those requirements can be incorporated into the System Security Plan and overall security controls. The IS owner cannot independently determine the protection needs of data they do not own, making this collaborative input mandatory under NIST and DoD information security frameworks.

Reviewing the Security Assessment Report (SAR) and authorizing the system is the responsibility of the Authorizing Official (AO), not the information owner, making this an incorrect role assignment.

Developing and maintaining the System Security Plan (SSP) is the responsibility of the Information System (IS) owner, not the individual information owners who share the system.

Moving data to a separate system is not a required or practical obligation; shared systems are a common and acceptable architecture as long as appropriate security controls are in place for all data owners.