CRISC Question #234: Real Exam Question with Answer & Explanation

Question

Which of the following should be accountable for ensuring that media containing financial information are adequately destroyed per an organization's data disposal policy?

Options

• ACompliance manager
• BData architect
• CData owner
• DChief information officer (CIO)

Explanation

The data owner is ultimately accountable for ensuring that media containing their financial information are adequately destroyed according to the organization's data disposal policy.

Common mistakes.

• A. A compliance manager ensures policies are followed but is not ultimately accountable for the data itself, which is a data owner's responsibility.
• B. A data architect designs data systems but is not typically accountable for the operational process of data disposal.
• D. The CIO has overall responsibility for IT, but data ownership is a more granular role accountable for specific data sets and their lifecycle management.

Concept tested. Data ownership responsibilities

Reference. https://csrc.nist.gov/glossary/term/data_owner

No community discussion yet for this question.