5.2 Data Ownership, Custodianship & Governance Roles
Key Takeaways
- The Information Asset Owner (Data Owner) is a business executive who holds ultimate fiduciary accountability for data classification, access authorization, and risk acceptance.
- The Information Custodian (Data Custodian) is an operational IT specialist responsible for executing technical controls, backups, encryption, and patch maintenance mandated by the owner.
- System Owners manage underlying infrastructure hosting environments but do not possess the business authority to classify datasets or approve user access permissions.
- Data Stewards operate at the business domain level to ensure data quality, regulatory compliance, metadata consistency, and operational lifecycle adherence.
- Under no circumstances may technical IT administrators or security risk managers accept business risk on behalf of an organizational unit.
5.2 Data Ownership, Custodianship & Governance Roles
A frequent root cause of enterprise security breaches and compliance failures is organizational role confusion. When technical IT staff make unilateral decisions regarding data access, or when business executives disclaim responsibility for cybersecurity safeguards, governance collapses.
ISACA establishes a clear, non-negotiable division of responsibilities based on the RACI Framework (Responsible, Accountable, Consulted, Informed). In information risk management, Business Asset Owners maintain ultimate accountability for data valuation, classification, and risk acceptance, while Technical Custodians execute the operational safeguards required to enforce those decisions.
+-----------------------------------------------------------------------------+
| DATA GOVERNANCE ROLE HIERARCHY & RACI |
| |
| +---------------------------------------------------------------------+ |
| | INFORMATION ASSET OWNER (DATA OWNER) - (Accountable - A) | |
| | - Senior Business Leader (e.g., VP Finance, Chief Medical Officer) | |
| | - Determines data classification tier & business valuation | |
| | - Approves user access requests & defines retention schedules | |
| | - Authorizes risk treatment & ACCEPTS RESIDUAL RISK | |
| +-----------------------------------+---------------------------------+ |
| | Mandates Policies & Controls |
| v |
| +---------------------------------------------------------------------+ |
| | DATA STEWARD (Operational Governance - R/C) | |
| | - Business domain expert; maintains data dictionaries & quality | |
| | - Enforces day-to-day classification rules & metadata consistency | |
| +-----------------------------------+---------------------------------+ |
| | Defines Technical Specs |
| v |
| +---------------------------------------------------------------------+ |
| | INFORMATION CUSTODIAN (DATA CUSTODIAN) - (Responsible - R) | |
| | - IT Engineering, Database Administrators (DBAs), Cloud Ops | |
| | - Implements technical encryption, access control lists (ACLs) | |
| | - Executes automated backups, disaster recovery, & media purge | |
| | - CANNOT grant access or accept risk unilaterally | |
| +---------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------+
1. The Information Asset Owner (Data Owner)
The Information Asset Owner (commonly referred to as the Data Owner) is a senior business executive or department head who is ultimately accountable for the business process that creates, uses, or relies upon the information asset.
Primary Accountabilities of the Data Owner:
- Classification Determination: Assigning the appropriate sensitivity tier (Public, Internal, Confidential, Restricted) based on the asset's business criticality and legal/regulatory mandates.
- Access Authorization Criteria: Defining baseline access eligibility criteria (who needs access to perform business functions) and approving non-standard access requests.
- Retention & Disposal Guidelines: Establishing how long records must be maintained to satisfy business, statutory, and contractual requirements, and authorizing final destruction.
- Recovery & Resilience Objectives: Defining the Maximum Tolerable Downtime (MTD), Recovery Time Objective (RTO), and Recovery Point Objective (RPO) based on business impact.
- Residual Risk Acceptance: Evaluating risk assessment findings and formally signing off on risk mitigation plans or accepting residual risk within enterprise appetite.
- Periodic User Access Recertification: Formally reviewing and recertifying user access permissions on a scheduled basis (e.g., quarterly or semi-annually).
[!IMPORTANT] The Golden Governance Rule of Risk Ownership: Accountability cannot be delegated. While a Data Owner may delegate operational tasks to Data Stewards or IT Custodians, the Data Owner remains personally accountable for the protection, compliance, and risk status of the information asset.
2. The Information Custodian (Data Custodian)
The Information Custodian (or Data Custodian) represents the technical entity or individual responsible for implementing, maintaining, and operating the technical safeguards mandated by the Data Owner.
Core Operational Responsibilities of the Data Custodian:
- Technical Control Implementation: Configuring technical access controls, Role-Based Access Control (RBAC) matrices, multifactor authentication (MFA), and firewall filtering rules.
- Data Protection Enforcement: Deploying and maintaining cryptographic mechanisms for data at rest (e.g., AES-256 transparent database encryption) and data in transit (TLS 1.3).
- Backup and Recovery Operations: Executing scheduled data backups, managing offsite replication, and performing routine restoration drills to ensure recovery time objectives (RTO/RPO) are achievable.
- System Maintenance & Patching: Applying security updates, vulnerability remediations, and configuration hardening standards to servers, databases, and network hosts.
- Media Sanitization: Executing NIST SP 800-88 sanitization protocols (Clear, Purge, Destroy) when storage media reaches end-of-life.
+-----------------------------------------------------------------------------+
| DATA OWNER vs. DATA CUSTODIAN COMPARISON |
| |
| DIMENSION DATA OWNER (BUSINESS) DATA CUSTODIAN (IT) |
| ------------------ -------------------------- ------------------------ |
| Organizational Unit Business Line (Finance, HR) IT / Security / Cloud Ops|
| Primary Focus Business Value & Risk Technical Execution |
| RACI Designation Accountable (A) Responsible (R) |
| Classification Role Determines Classification Enforces Security Tags |
| Access Role Approves / Denies Access Provisions Approved ACLs |
| Risk Role Accepts Residual Risk Reports Technical Issues |
| Disposal Role Authorizes Destruction Executes Media Shredding |
+-----------------------------------------------------------------------------+
3. Complementary Governance Roles: System Owners & Data Stewards
To ensure comprehensive lifecycle governance, enterprise frameworks distinguish several supporting roles:
+-----------------------------------------------------------------------------+
| INTERACTION OF DATA, SYSTEM, AND PROCESS OWNERS |
| |
| +---------------------------------------------------------------------+ |
| | PROCESS OWNER (e.g., Head of Global Payroll Operations) | |
| | - Designs the business workflow and transaction lifecycle | |
| +-----------------------------------+---------------------------------+ |
| | Uses & Directs |
| v |
| +---------------------------------------------------------------------+ |
| | DATA OWNER (e.g., VP of Human Resources) | |
| | - Owns the employee payroll records & tax identification datasets | |
| | - Classifies data as RESTRICTED and sets access rules | |
| +-----------------------------------+---------------------------------+ |
| | Hosted On |
| v |
| +---------------------------------------------------------------------+ |
| | SYSTEM OWNER (e.g., Director of Enterprise Cloud Infrastructure) | |
| | - Manages the multi-tenant AWS SAP / Oracle ERP Platform | |
| | - Ensures platform patch compliance, OS uptime, and hypervisor risk | |
| +---------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------+
Role Definitions:
- System Owner: The manager responsible for the procurement, development, integration, modification, and maintenance of the underlying IT system (hardware, operating system, and middleware platform). Key distinction: A System Owner may host dozens of distinct datasets belonging to different Data Owners on a single corporate ERP server.
- Process Owner: The individual responsible for the end-to-end design, execution, and performance of a business process (e.g., Order-to-Cash, Procure-to-Pay).
- Data Steward: A business-domain subject matter expert appointed by the Data Owner to ensure data quality, metadata definitions, schema standardization, and adherence to regulatory data management policies on a daily basis.
- End-User: Any employee, contractor, or business partner granted access to information assets. Users are responsible for adhering to the Acceptable Use Policy (AUP), maintaining credential confidentiality, and immediately reporting suspicious security anomalies.
4. Enterprise RACI Matrix for Information Asset Governance
A defensible risk management program establishes an explicit RACI matrix across all lifecycle milestones:
| Governance Activity | Board / Exec | Data Owner | System Owner | Data Custodian | Data Steward | Risk / CISO | End-User |
|---|---|---|---|---|---|---|---|
| Establish Enterprise Data Policy | A | C | C | I | C | R | I |
| Classify Information Asset | I | A | I | I | R | C | I |
| Approve User Access Request | I | A | I | I | C | C | I |
| Provision Technical Access (ACLs) | I | I | C | A / R | I | I | I |
| Quarterly User Access Review (UAR) | I | A | I | C | R | C | I |
| Implement Backup & Encryption | I | I | C | A / R | I | C | I |
| Accept Residual IT Risk | C | A | I | I | I | C | I |
| Authorize Asset Decommissioning | I | A | C | R | C | I | I |
| Adhere to Acceptable Use Policy | I | I | I | I | I | I | A / R |
Legend: A = Accountable (Final decision/ownership); R = Responsible (Task execution); C = Consulted (Two-way input); I = Informed (One-way update).
5. Access Governance & User Access Reviews (UAR)
Granting access is only half of the access governance lifecycle. Over time, organizational role changes, promotions, and transfers lead to Privilege Creep (the gradual accumulation of unnecessary access rights).
+-----------------------------------------------------------------------------+
| USER ACCESS RECERTIFICATION LIFECYCLE (UAR) |
| |
| [1. EXTRACT ACCESS LISTS] ---> IT Custodian pulls active user accounts |
| | |
| v |
| [2. STAGING & ENRICHMENT] ---> HR data attached (department, manager) |
| | |
| v |
| [3. OWNER RECERTIFICATION] ---> DATA OWNER reviews line-by-line: |
| | - APPROVE (legitimate business need) |
| | - REVOKE (unneeded / transferred) |
| v |
| [4. TECHNICAL REMEDIATION] ---> IT Custodian revokes unapproved accounts |
| | |
| v |
| [5. INDEPENDENT AUDIT] ---> Risk / Internal Audit validates closure |
+-----------------------------------------------------------------------------+
Core Governance Standards for UAR:
- Frequency: High-risk / Restricted systems require at least quarterly access reviews; standard Internal systems require annual reviews.
- Segregation of Duties (SoD): The IT Custodian must never perform self-recertification. The Data Owner (or designated business manager) must validate business justification.
- Timely Revocation SLA: Revocation of terminated employee access must occur within a strictly enforced Service Level Agreement (typically immediate or $\le 24$ hours).
6. Real-World Case Vignette & Exam Traps
+-----------------------------------------------------------------------------+
| CRISC REAL-WORLD CASE: THE UNAUTHORIZED DBA |
| |
| SCENARIO: |
| A lead Database Administrator (DBA) at a regional hospital received a |
| request from an external clinical research partner for access to a |
| historical patient clinical trial database. |
| |
| THE GOVERNANCE FAILURE: |
| To expedite the research project, the DBA created a database account and |
| granted direct access without obtaining sign-off from the Chief Medical |
| Officer (the designated Data Owner). |
| |
| CONSEQUENCES: |
| The external partner suffered a ransomware breach 3 months later. Federal |
| investigators cited the hospital for severe HIPAA Privacy Rule violations |
| due to unauthorized data disclosure and lack of Data Owner governance. |
| |
| ROOT CAUSE: |
| The DBA acted as both Custodian and Approver, violating Segregation of |
| Duties. Only the Data Owner has statutory authority to approve access. |
+-----------------------------------------------------------------------------+
[!CAUTION] Classic Exam Trap — The IT Risk Acceptance Trap: If an exam question asks: "The Chief Information Officer (CIO) or Lead Security Architect decides to accept the risk of not patching an end-of-life database to avoid operational downtime. Is this acceptable?" The answer is NO. IT leadership and security architects are custodians and technical advisors; only the business unit executive (Data Owner / Business Process Owner) whose operations depend on the asset has the fiduciary authority to accept business risk.
A newly deployed ERP application contains sensitive financial records. A developer requests elevated read-write permissions to troubleshoot a production issue. Who holds the PRIMARY authority to approve this access request?
During a quarterly user access review (UAR), an internal auditor discovers that an IT systems administrator approved their own privileged account permissions. Which fundamental governance control was violated?
A multi-tenant cloud application hosts customer datasets belonging to fifty different corporate clients on shared physical servers. In this architecture, how is the role of the Cloud Infrastructure Provider BEST categorized?
An IT security engineer discovers that an legacy customer database lacks column-level encryption, creating a compliance non-conformity. The security engineer recommends upgrading the database, but the business unit manager decides to accept the risk due to budget constraints. Who is ultimately ACCOUNTABLE for this risk acceptance decision?