A school district chart lists 'everyone is responsible for security' with no RACI for data owners versus custodians. How should leadership clarify roles?
Select an answer to reveal the explanation.
Short Explanation
'Everyone is responsible' sounds noble until nobody owns classification or backups. Owners decide value and rules; custodians keep the systems healthy; users follow the rules. A RACI chart turns the slogan into actual job clarity.
Full Explanation
Clear accountability requires distinguishing data owners, custodians, and users rather than relying on slogans. When a school district chart says 'everyone is responsible for security' with no RACI, leadership should define and document distinct responsibilities: owners set classification and acceptable use for data under their charge, custodians implement and maintain technical protections, and users handle data according to policy. A RACI-style model converts shared aspiration into assignable duties and measurable performance.
Keeping the slogan while adding shared generic passwords worsens both accountability and access control, inviting credential sprawl under the banner of teamwork. Assigning all ownership solely to the help desk so teachers never see data labels misplaces ownership—help desk staff are typically custodians or operators, not business owners of student or staff data. Declaring that custodians set classification policy while owners only install patches reverses the model: classification and valuation belong with owners; patching and platform care belong with custodians.
Exam caveat: CISSP loves owner-versus-custodian distinctions. 'Everyone is responsible' is almost always the wrong governance posture when the stem asks how to clarify roles.
Operational check: Publish a RACI for key data domains (student records, HR, finance), name owners by role, map custodians to systems, train users on classification labels, and audit that backup, access, and retention tasks have named accountable parties.