Which of the following, who should be PRIMARILY responsible for performing user entitlement reviews?

The IT security manager is responsible for defining security policies and ensuring controls are in place, but not for the specific business approval of individual user access to data.

IT personnel are responsible for implementing and managing access controls based on approvals, but they generally lack the business context to determine appropriate user entitlements.

The data custodian (e.g., database administrator) is responsible for the technical safeguarding and maintenance of data, not for making business decisions about who is authorized to access it.

The data owner has the ultimate accountability for the data and possesses the necessary business context to determine who should legitimately have access, making them primarily responsible for reviewing and approving user entitlements.