Information Asset Ownership

An important part of the process of building

Owners define who uses the and maintaining an information asset information and what permission inventory is identifying a responsible person level a user has, how long the or organization as an asset's owner-the information should be stored, and person or organizational unit with the whether it can be shared with other responsibility for imposing information security and quality guidelines, policies, or functions inside and outside the requirements for that asset. This does not organization.

mean that the asset owner builds, maintains, or monitors those information security controls, nor do they control all processing

Note that NIST SP 800-18, Rev. 1- Guide done with that data. Instead, the asset owner for Developing Security Plans for Federal provides an authoritative voice for security

Information Systems and the European and data quality standards and practices

Union's General Data Protection Regulation applied to that asset. An asset owner is not

(GDPR) have somewhat different definitions always the person who created a specific of this role and of other roles concerning the piece of information, but they are the one handling of data.

accountable for its creation and use.

The owner must have the knowledge and ability to classify and categorize properly. This requires both in-domain knowledge and experience of business logic and its use of the information, a working knowledge of security controls, and knowledge of compliance requirements that might apply. When any of these knowledge and skill sets are incomplete, incorrect, or out of date, data owners may be tempted to err on the side of caution and apply a higher sensitivity category or classification to the data than is required. The establishment of an asset classification and categorization board, or committee, with proper membership from key areas of the organization, will have the overall corporate perspective of the value of assets and can address or alleviate this problem.

Classification and categorization should be done based on the value of the asset, but there are elements that owners need to take into consideration to determine the correct value of the asset. Awareness and understanding of the laws and regulations, as well as business needs, would allow the data owner to fully assess the asset's value.