CRISC · Question #234
Which of the following should be accountable for ensuring that media containing financial information are adequately destroyed per an organization's data disposal policy?
The correct answer is C. Data owner. The data owner is ultimately accountable for ensuring that media containing their financial information are adequately destroyed according to the organization's data disposal policy.
Question
Which of the following should be accountable for ensuring that media containing financial information are adequately destroyed per an organization's data disposal policy?
Options
- ACompliance manager
- BData architect
- CData owner
- DChief information officer (CIO)
How the community answered
(21 responses)- A5% (1)
- C95% (20)
Why each option
The data owner is ultimately accountable for ensuring that media containing their financial information are adequately destroyed according to the organization's data disposal policy.
A compliance manager ensures policies are followed but is not ultimately accountable for the data itself, which is a data owner's responsibility.
A data architect designs data systems but is not typically accountable for the operational process of data disposal.
The data owner is a business role with ultimate responsibility for the data's integrity, confidentiality, and availability throughout its lifecycle, including its proper disposal. This accountability extends to ensuring that media containing their data are destroyed in compliance with organizational policies and regulatory requirements.
The CIO has overall responsibility for IT, but data ownership is a more granular role accountable for specific data sets and their lifecycle management.
Concept tested: Data ownership responsibilities
Source: https://csrc.nist.gov/glossary/term/data_owner
Topics
Community Discussion
No community discussion yet for this question.