An organization has contracted with a cloud service provider to support the deployment of a new product. Of the following, who should own the associated risk?

The head of enterprise architecture is responsible for the overall design and strategy of IT systems, not the specific operational risks of a new product.

The IT risk manager's role is to identify, assess, and advise on risks, but not to *own* the operational risks of a specific business product.

The information security manager is responsible for managing security risks, which are a component of product risk, but not the entirety of the product's business and operational risks.

The product owner is ultimately responsible for the success and failure of the product, including its operational aspects and how it performs in the market. As such, they are the primary stakeholder who benefits from its success and bears the consequences of its risks, making them the appropriate owner for associated risks.