CISSP Asset Security Practice Question
A data breach has occurred involving a database that contains personally identifiable information (PII). As part of incident response, the organization needs to identify all roles responsible for data protection. Which TWO roles are primarily accountable for data classification and protection requirements according to typical data governance frameworks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Senior management
The data owner is accountable for classification and protection requirements, while senior management has ultimate accountability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Senior management
Why this is correct
Senior management holds the ultimate accountability for an organization's overall data protection posture and compliance. They are responsible for establishing the overarching security policy, allocating necessary resources, and ensuring that appropriate governance structures are in place. This includes accepting the residual risk associated with data breaches and bearing the legal and reputational consequences, making them the final arbiter of data protection strategy.
- ✗
Data subject
Why it's wrong here
A data subject is an individual whose personal data is being processed, stored, or managed by an organization. While data subjects possess rights regarding their data, such as access or erasure, they do not hold organizational accountability for the data's classification, protection, or the occurrence of a breach. Their role is passive in terms of internal data governance responsibilities within the processing entity.
- ✗
Data steward
Why it's wrong here
The data steward is primarily responsible for the quality, integrity, and proper definition of specific data elements within the organization. Their role involves ensuring data accuracy, consistency, and adherence to business rules, often managing metadata and data dictionaries. While critical for data governance, a data steward does not typically hold the ultimate accountability for data classification or the overall security posture, focusing more on data utility and consistency.
- ✗
Data custodian
Why it's wrong here
The data custodian is responsible for the technical implementation and maintenance of security controls to protect the data as defined by the data owner and organizational policies. This role involves operational tasks such as managing databases, configuring access controls, performing backups, and ensuring system availability. However, custodians do not determine the data's classification level or define its protection requirements; they merely execute the prescribed security measures.
- ✓
Data owner
Why this is correct
The data owner is the business unit or individual accountable for the specific data set, responsible for determining its classification based on sensitivity, value, and regulatory requirements. They define the appropriate protection requirements and acceptable use policies for that data, ensuring controls align with its criticality. This role bears the primary responsibility for assessing the impact of a breach and approving the security measures necessary to mitigate risks.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Data classification
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.