If an accounting department's computer system was compromised, who should make the decision about when that system is put back into production?

The lead incident handler manages the technical response process but does not hold business authority over system availability decisions.

The CIO or Head of IS has broad governance authority but the designated system owner is the appropriate decision maker for their specific system.

The system owner is the individual responsible for the business function the system supports and bears accountability for its risk posture. They are positioned to weigh business impact against recovery completeness and make the final authorization decision. This is a foundational principle in NIST incident response and IT governance frameworks.

The system administrator performs technical operations but lacks the business accountability and authority to authorize a system's return to production.