Exam CISM topic 1 question 899 discussion

For classifying the data I agree that Information Owner is responsible, but for designing the framework? I would say Information Security Manager.

Correct answer is D. Information Security Manager because he is the primary doer in developing the classification framework. The steering committee supports and approves, but doesn’t create.

Either A or D because Senior management is not responsible for developing anything. Either they are accountable or approve but do not develop. The best answer is ISM in conjunction with Information Owner but here both choices are given.

It says "for developing an information classification framework", the information owner FOLLOWs the framework, but does not develop it... I would go for C

It should be D.

A. Information owner Information owners are typically responsible for classifying and categorizing information assets based on their importance and sensitivity to the organization. They work closely with business units to understand the value and requirements of the information, and they play a key role in determining how information should be classified and protected.

C. Senior management

I think that information owners are responsible for making decisions about the classification and protection of specific information assets within their radar. They understand the value and sensitivity of the information they manage and are in the best position to determine how it should be classified as well as protected to align with business needs.