2 cissp ® Official Study Guide Eighth Edition

Asset Owners 
The asset owner (or system owner) is the person who owns the asset or system that processes 
sensitive data. NIST SP 800-18 outlines the following responsibilities for the system owner: 
■
Develops a system security plan in coordination with information owners, the system 
administrator, and functional end users 
■
Maintains the system security plan and ensures that the system is deployed and oper-
ated according to the agreed-upon security requirements 
■
Ensures that system users and support personnel receive appropriate security training, 
such as instruction on rules of behavior (or an AUP) 
■
Updates the system security plan whenever a significant change occurs 
■
Assists in the identification, implementation, and assessment of the common security 
controls

---

180
Chapter 5 
■
Protecting Security of Assets
The system owner is typically the same person as the data owner, but it can sometimes 
be someone different, such as a different department head (DH). As an example, consider a 
web server used for e-commerce that interacts with a back-end database server. A software 
development department might perform database development and database administration 
for the database and the database server, but the IT department maintains the web server. 
In this case, the software development DH is the system owner for the database server, and 
the IT DH is the system owner for the web server. However, it’s more common for one per-
son (such as a single department head) to control both servers, and this one person would 
be the system owner for both systems.
The system owner is responsible for ensuring that data processed on the system remains 
secure. This includes identifying the highest level of data that the system processes. The sys-
tem owner then ensures that the system is labeled accurately and that appropriate security 
controls are in place to protect the data. System owners interact with data owners to ensure 
that the data is protected while at rest on the system, in transit between systems, and in use 
by applications operating on the system.