nerdexam
(ISC)2

CSSLP · Question #235

Which of the following are the responsibilities of the owner with regard to data in an information classification program? Each correct answer represents a complete solution. Choose three.

The correct answer is A. Reviewing the classification assignments at regular time intervals and making changes as the business C. Delegating the responsibility of the data protection duties to a custodian. D. Determining what level of classification the information requires. Data owners are responsible for defining the classification of information, reviewing these classifications periodically, and delegating the operational protection tasks to data custodians.

Secure Software Concepts

Question

Which of the following are the responsibilities of the owner with regard to data in an information classification program? Each correct answer represents a complete solution. Choose three.

Options

  • AReviewing the classification assignments at regular time intervals and making changes as the business
  • BRunning regular backups and routinely testing the validity of the backup data.
  • CDelegating the responsibility of the data protection duties to a custodian.
  • DDetermining what level of classification the information requires.

How the community answered

(51 responses)
  • A
    94% (48)
  • B
    6% (3)

Why each option

Data owners are responsible for defining the classification of information, reviewing these classifications periodically, and delegating the operational protection tasks to data custodians.

AReviewing the classification assignments at regular time intervals and making changes as the businessCorrect

Data owners are ultimately accountable for the data, which includes ensuring its classification remains appropriate and current as business needs or regulations change.

BRunning regular backups and routinely testing the validity of the backup data.

Running regular backups and testing their validity are operational tasks typically performed by a data custodian or system administrator, not the primary responsibility of the data owner.

CDelegating the responsibility of the data protection duties to a custodian.Correct

While the owner is accountable for the data, the operational tasks of data protection, such as implementing controls, are typically delegated to data custodians.

DDetermining what level of classification the information requires.Correct

The data owner is the primary individual responsible for deciding the sensitivity and value of the information, thereby determining its appropriate classification level.

Concept tested: Data owner responsibilities in classification programs

Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-18r1.pdf

Topics

#Data Owner Responsibilities#Information Classification#Data Governance#Data Protection Roles

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CSSLP Practice