In business-critical applications, user access should be approved by the:

A.
information security manager.

B.
data owner.

C.
data custodian.

D.
business management.

Explanation:

A data owner is in the best position to validate access rights to users due to their deep
understanding of business requirements and of functional implementation within the application.
This responsibility should be enforced by the policy. An information security manager will
coordinate and execute the implementation of the role-based access control. A data custodian will
ensure that proper safeguards are in place to protect the data from unauthorized access; it is not
the data custodian’s responsibility to assign access rights. Business management is not. in all
cases, the owner of the data.