13. Mission, data, system owners, and data custodians

Question 1

Mission, data, system owners, and data custodians

Mission/Business Owners

Answer 1

Senior executives

• Make the policies that govern data security

Question 2

Mission, data, system owners, and data custodians

Data/Information Owners

Answer 2

Management Level

• Assign sensitivity labels and backup frequency
• Approve access but do not grant access

Question 3

Mission, data, system owners, and data custodians

Data Custodians

Answer 3

Technical Hands-on Employees

• Hands on employees who do backups, restores, patches and system config
• Do backups and restores at the direction of the data owner

Question 4

Mission, data, system owners, and data custodians

System Owner

Answer 4

Management Level

• Owner of the systems that house the data
• Responsible for security profile of the system
• Data center manager or infrastructure manager as example

Question 5

Mission, data, system owners, and data custodians

Data Controllers

Answer 5

Create and manage sensitive data

• For example, HR or Payroll
• Security could audit the processes of teams to ensure they are handling data correctly

Question 6

Mission, data, system owners, and data custodians

Data Processors

Answer 6

Manage data for controllers

• for example, outsourced payroll

Question 7

Mission, data, system owners, and data custodians

Security Administrators

Answer 7

1. Firewalls
2. IPS / IDS
3. Security patches
4. Account creation
5. Assign access to data

Question 8

Mission, data, system owners, and data custodians

Supervisors

Answer 8

1. Responsible for user behaviour and assets created by users
2. Responsible for user awareness
3. Needs to inform Sec admin of changes to employment of users and permissions

Question 9

Mission, data, system owners, and data custodians

Users

Answer 9

Users of the data

• Must be trained and made aware
• Need to understand what is acceptable and not acceptable
• Understand the consequences of not following policies, procedures, and standards

Question 10

Mission, data, system owners, and data custodians

Auditors

Answer 10

Reviewing and confirming security policies are implemented

• validate they provide the protection that they should
• Can be internal or external