Exam CISA topic 1 question 1250 discussion

Data owners classify and security admins ensure

A. Classifies documents to correctly reflect the level of sensitivity of information they contain

The role of a document owner when implementing a data classification policy in an organization is primarily to classify documents to correctly reflect the level of sensitivity of the information they contain. The document owner is responsible for determining the appropriate classification level based on the content and the potential impact if the information were to be disclosed, altered, or destroyed without authorization. This classification guides how the document should be handled, stored, and shared within the organization

Document owners understand exactly what information the documents they manage contain and assess the sensitivity level of that information. They ensure that how documents are handled is according to the assessed sensitivity level. This includes access control, storage methods, and transmission methods. They monitor that document handling complies with policies, and make corrections or updates as necessary.

Answer B is better than A. Option A: Focuses on the initial classification process, ensuring the owner accurately assigns the sensitivity level based on the information in the document. Option B: Emphasizes the ongoing responsibility of the owner to make sure the document is handled appropriately after classification. This includes implementing security measures, access controls, and proper disposal procedures based on its sensitivity.