The marketing department has created a new customer analytics data set combining purchase history and contact details. Who should assign its classification?
Select an answer to reveal the explanation.
Short Explanation
Think of it like this: the person who owns the house decides how valuable the jewelry is; the security guard just locks it up accordingly. Data owners classify, and you, as the security manager, set the rules for how classification works.
Full Explanation
Classification reflects the business value and sensitivity of information, so it is the responsibility of the data owner, typically a business manager accountable for the data set and its use. The owner understands the information's purpose, who needs it and the consequences of disclosure, alteration or loss, and is accountable for the resulting protection decisions. The information security manager supports the process by maintaining the classification policy and scheme, advising owners and monitoring compliance, but does not own the business data or decide its value. The database administrator acts as a custodian, implementing the protections that the classification requires, such as access controls and backups; custodians apply decisions rather than making them. Internal audit provides independent assurance that classification is performed and applied correctly, and assigning classifications would compromise that independence. Exam caveat: owners may delegate the day-to-day labeling task, but accountability for the classification remains with the owner. Operational check: confirm the asset inventory records a named business owner for the data set, the assigned classification and the date it was set, with handling controls implemented by the custodian.