Who should be accountable for authorizing information system access to internal users?

An Information Security Officer is responsible for developing and implementing security policies and advising on security, not typically for day-to-day access authorization decisions.

An Information Security Manager manages the security program and team but does not typically have the business context to authorize access for specific data, which belongs to the owner.

An Information Custodian is responsible for the technical protection and maintenance of the information system (e.g., IT department), not for deciding who should access the data contained within.

The information owner, also known as the data owner, is the person or entity ultimately responsible for the specific data or information system. They have the ultimate authority and accountability for determining its value, classifying it, and deciding who should have access, based on business need and organizational policy. This ensures that access is granted by someone who understands the data's criticality and purpose.