CISSP Asset Security Practice Question
A government contractor handles classified information up to the Secret level. The company's data classification policy recently changed, requiring that all documents marked as 'Confidential' be reclassified as 'Secret' after review. Who is ultimately accountable for ensuring that reclassification is performed correctly?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data owner
The data owner is the senior-level manager accountable for data classification and protection. They have the authority and responsibility to assign classification levels and ensure data is properly classified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data custodian
Why it's wrong here
The data custodian is primarily responsible for the operational implementation and maintenance of security controls as directed by the data owner. This includes tasks like data storage, backup, encryption, and access control enforcement. They ensure the physical and technical safeguards are in place but do not make decisions regarding the data's sensitivity or classification level itself.
- ✗
Data subject
Why it's wrong here
The data subject is the individual to whom specific data pertains, particularly in the context of personal identifiable information (PII). While they possess rights concerning their own data, such as access or rectification, they hold no organizational responsibility for classifying data or implementing security measures. Their role is passive in terms of data governance and security accountability.
- ✗
Data steward
Why it's wrong here
A data steward focuses on the quality, integrity, and consistency of data within an organization, often managing metadata and data dictionaries. They ensure data definitions are clear and standards are followed, which supports effective data management and classification efforts. However, their accountability lies in data usability and reliability, not the ultimate decision for a data asset's security classification level.
- ✓
Data owner
Why this is correct
The data owner holds ultimate organizational accountability for the protection and classification of specific data assets, often a senior business manager. They are responsible for determining the data's sensitivity (e.g., Top Secret, Confidential) and approving access requirements based on business needs and regulatory compliance. This role ensures appropriate security controls are defined and implemented to safeguard the information throughout its lifecycle, bearing the risk of mishandling.
Go deeper
Related to this question
Learn chapter
Asset Security: Classification and Handling
Key term
Data classification
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.