The responsibility for authorizing access to a business application system belongs to the:

A.
data owner.

B.
security administrator.

C.
IT security manager.

D.
requestor’s immediate supervisor.

Explanation:

When a business application is developed, the best practice is to assign an information or data
owner to the application. The Information owner should be responsible for authorizing access to
the application itself or to back-end databases for queries. Choices B and C are not correct
because the security administrator and manager normally do not have responsibility for
authorizing access to business applications. The requestor’s immediate supervisor may share the
responsibility for approving user access to a business application system; however, the final
responsibility should go to the information owner.