Once the types of information have been identified, who should an information security practitioner work with to ensure that the information is properly categorized?

The Information Owner (IO) is the individual responsible for the business function that relies on the data and holds the authority to formally classify and categorize it. Security practitioners work with IOs because they understand the data's sensitivity, regulatory requirements, and business impact, making them the authoritative source for proper categorization decisions.

The System Administrator is responsible for implementing and maintaining technical controls on systems, not for determining the business value or sensitivity classification of the information itself.

The Business Continuity Manager focuses on ensuring organizational resilience and recovery planning during disruptions, and is not the designated authority for data classification or categorization.

While the CIO provides strategic IT leadership and oversight, they delegate the specific responsibility of information categorization to the Information Owner who has direct accountability for the data.