When developing the entitlement review process, which of the following roles is responsible for determining who has a need for the information?

The Data Owner is the senior-level management role with ultimate responsibility for a specific data asset. This accountability includes determining the data's classification, protection requirements, and, most importantly, defining access control policies. During an entitlement review, the Data Owner is responsible for validating that access rights are appropriate by determining who has a legitimate business "need-to-know." They make the authoritative decisions on granting or revoking access based on business requirements, while other roles implement these decisions.

1. (ISC)² CISSP Official Study Guide

9th Edition. Domain 2: Asset Security

Chapter 5

"Protecting Security of Assets." The text specifies

"The data owner is responsible for ensuring that the necessary security controls are in place... Data owners are also responsible for determining access rights." (p. 178).

2. NIST Special Publication 800-18

Revision 1

Guide for Developing Security Plans for Federal Information Systems. Section 3.2

"Roles and Responsibilities." This guide defines the Information Owner as an "official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation

collection

processing

dissemination

and disposal." This authority includes defining access rules. (p. 11).

3. Carnegie Mellon University

Software Engineering Institute

Defining Data Security. In discussions of data governance roles

it is consistently established that the Data Owner is a business function role

not an IT role. The owner is accountable for the data and is the one who grants authority for access. This is distinct from the Data Custodian

who manages the data on a technical level. (Referenced in various course materials on data governance

e.g.

CISO Program).

4. ISACA

COBIT 5: A Business Framework for the Governance and Management of Enterprise IT. The framework's processes

such as APO01 (Manage the IT Management Framework) and DSS05 (Manage Security Services)

implicitly and explicitly assign accountability for information assets to business owners who must define requirements for confidentiality

integrity

and availability

which includes access rights.