easyMultiple SelectObjective-mapped
CISSP Practice Question: Which THREE of the following are recognized roles…
Which THREE of the following are recognized roles in asset security?
⚠ Common exam trap
It's easy for candidates to confuse the data subject (a GDPR-defined individual) with a security role, or mistakenly think the data auditor is a primary asset security role, when the CISSP framework explicitly lists only data owner, data custodian, and data processor as the recognized roles in asset security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data custodian
The data custodian (A) is responsible for implementing and maintaining security controls according to the data owner's directives, such as applying encryption, managing backups, and enforcing access controls. This role is recognized in asset security because it bridges policy and operational execution, ensuring the CIA triad is maintained on the stored or processed data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data custodian
Why this is correct
The data custodian is responsible for the operational implementation and maintenance of security controls and safeguards for information assets. This includes tasks such as data backup, system patching, access control enforcement, and ensuring data integrity and availability according to the policies established by the data owner. They act as the 'hands-on' technical and administrative staff who manage the data on a day-to-day basis.
- ✓
Data owner
Why this is correct
The data owner holds ultimate accountability for the protection and classification of specific information assets. This role involves making critical decisions regarding data sensitivity, defining access policies, determining retention periods, and ensuring compliance with legal and regulatory requirements. They are typically a senior manager or business unit head who understands the data's business value and associated risks.
- ✓
Data processor
Why this is correct
A data processor is an entity, often a third-party organization or a distinct internal department, that processes personal data on behalf of a data controller (which is frequently the data owner). Their activities are strictly governed by contractual agreements and instructions from the controller, without independent authority to determine the purposes or means of processing. This role is common in cloud services or outsourced data management scenarios.
- ✗
Data subject
Why it's wrong here
The data subject is the individual person to whom specific personal data relates, such as a customer, employee, or patient. While their privacy rights and the security of their data are paramount concerns in asset security, the data subject does not actively perform a governance, operational, or administrative role within the asset security framework itself. They are the 'object' of protection, not a 'role' in the protection process.
- ✗
Data auditor
Why it's wrong here
A data auditor performs an independent assessment of an organization's information systems, security controls, and compliance with established policies, standards, and regulations. Unlike the data owner, custodian, or processor, the auditor's function is to evaluate and report on the effectiveness of these roles and controls, rather than directly managing or implementing them. Their role is one of oversight and assurance, providing an objective review of the security posture.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Asset
In IT and cybersecurity, an asset is anything valuable that an organization owns or controls, including data, hardware, software, people, and intellectual property.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.