When developing the entitlement review process, which of the following roles is responsible for determining who has a need for the information?

The Data Owner is the senior-level management role with ultimate responsibility for a specific data asset. This accountability includes determining the data's classification, protection requirements, and, most importantly, defining access control policies. During an entitlement review, the Data Owner is responsible for validating that access rights are appropriate by determining who has a legitimate business "need-to-know." They make the authoritative decisions on granting or revoking access based on business requirements, while other roles implement these decisions.

1. (ISC)² CISSP Official Study Guide, 9th Edition. Domain 2: Asset Security, Chapter 5, "Protecting Security of Assets." The text specifies, "The data owner is responsible for ensuring that the necessary security controls are in place... Data owners are also responsible for determining access rights." (p. 178).

2. NIST Special Publication 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems. Section 3.2, "Roles and Responsibilities." This guide defines the Information Owner as an "official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal." This authority includes defining access rules. (p. 11).

3. Carnegie Mellon University, Software Engineering Institute, Defining Data Security. In discussions of data governance roles, it is consistently established that the Data Owner is a business function role, not an IT role. The owner is accountable for the data and is the one who grants authority for access. This is distinct from the Data Custodian, who manages the data on a technical level. (Referenced in various course materials on data governance, e.g., CISO Program).

4. ISACA, COBIT 5: A Business Framework for the Governance and Management of Enterprise IT. The framework's processes, such as APO01 (Manage the IT Management Framework) and DSS05 (Manage Security Services), implicitly and explicitly assign accountability for information assets to business owners who must define requirements for confidentiality, integrity, and availability, which includes access rights.