Which organizational role should be accountable for ensuring information assets are appropriately classified?

A data protection officer oversees privacy regulations but does not typically own or classify specific assets.

The CIO is responsible for overall IT strategy and governance, not the granular classification of individual assets.

An information asset custodian manages and maintains the asset according to policies, but the owner defines the asset's classification.

The information asset owner is typically a business unit or individual who has ultimate responsibility for the asset's value, use, and protection, making them accountable for its appropriate classification. They best understand the asset's sensitivity, criticality, and regulatory requirements, thus dictating the necessary security controls based on classification.