mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A financial institution is implementing a data…
A financial institution is implementing a data classification policy. Which role is responsible for assigning initial classification labels to data assets?
⚠ Common exam trap
ISC2 often tests the distinction between data owner and data custodian, trapping candidates who confuse the 'owner' as the person who physically handles the data (custodian) rather than the person who has accountability for classification and risk acceptance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data owner
The data owner is the senior manager or business stakeholder who has ultimate accountability for a data asset and is responsible for determining its classification level based on business impact and sensitivity. In the CISSP framework, the data owner defines the classification labels (e.g., Public, Internal, Confidential, Restricted) at the time of creation or acquisition, ensuring the asset is tagged according to the organization's data classification policy. This role does not handle the technical implementation but sets the initial classification, which then drives downstream controls like encryption and access control lists (ACLs).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data custodian
Why it's wrong here
A data custodian is primarily responsible for the secure storage, transmission, and processing of data, implementing the technical controls mandated by the data owner's classification decisions. They ensure data protection measures, such as encryption and access controls, are correctly applied based on the assigned classification, but they do not determine the data's sensitivity or classification level themselves.
- ✗
Data processor
Why it's wrong here
A data processor handles data strictly according to the instructions provided by the data controller or owner, typically under a contractual agreement. Their role is to perform specific operations on data, such as storage or analysis, without any authority or responsibility for determining its classification or inherent sensitivity. Classification decisions remain with the entity that defines the data's purpose and context.
- ✓
Data owner
Why this is correct
The data owner holds ultimate accountability for the data's value, sensitivity, and the impact its compromise could have on the organization. They are responsible for defining the data classification levels and assigning the appropriate classification to specific datasets based on business criticality, regulatory requirements, and potential risk. This decision dictates the security controls and protection measures required throughout the data lifecycle.
- ✗
Data steward
Why it's wrong here
A data steward focuses on ensuring data quality, integrity, and adherence to established data governance policies and standards. While they work closely with data owners to implement and monitor classification policies, their primary role involves managing metadata, resolving data quality issues, and ensuring compliance, rather than initially assigning the data's classification level. They act as a liaison, facilitating the proper use and protection of classified data.
Visual reference
Go deeper
Related to this question
Learn chapter
Asset Security: Classification and Handling
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Asset
In IT and cybersecurity, an asset is anything valuable that an organization owns or controls, including data, hardware, software, people, and intellectual property.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.