2 cissp ® Official Study Guide Eighth Edition

179
Data Owners 
The
data owner
is the person who has ultimate organizational responsibility for data. The 
owner is typically the chief operating offi cer (CEO), president, or a department head (DH). 
Data owners identify the classifi cation of data and ensure that it is labeled properly. They also 
ensure that it has adequate security controls based on the classifi cation and the organization’s 
security policy requirements. Owners may be liable for negligence if they fail to perform due 
diligence in establishing and enforcing security policies to protect and sustain sensitive data. 
NIST SP 800-18 outlines the following responsibilities for the information owner, which 
can be interpreted the same as the data owner. 
■
Establishes the rules for appropriate use and protection of the subject data/information 
(rules of behavior) 
■
Provides input to information system owners regarding the security requirements and 
security controls for the information system(s) where the information resides 
■
Decides who has access to the information system and with what types of privileges or 
access rights 
■
Assists in the identification and assessment of the common security controls where the 
information resides.
NIST SP 800-18 frequently uses the phrase “rules of behavior,” which is 
effectively the same as an acceptable use policy (AUP). Both outline the 
responsibilities and expected behavior of individuals and state the conse-
quences of not complying with the rules or AUP. Additionally, individuals 
are required to periodically acknowledge that they have read, understand, 
and agree to abide by the rules or AUP. Many organizations post these on a 
website and allow users to acknowledge that they understand and agree to 
abide by them using an online electronic digital signature.