The responsibility for authorizing access to a business application system belongs to the:
A.
data owner.
B.
security administrator.
C.
IT security manager.
D.
requestor’s immediate supervisor.
Explanation:
When a business application is developed, the best practice is to assign an information or data
owner to the application. The Information owner should be responsible for authorizing access to the
application itself or to back-end databases for queries. Choices B and C are not correct because the
security administrator and manager normally do not have responsibility for authorizing access to
business applications. The requestor’s immediate supervisor may share the responsibility for
approving user access to a business application system; however, the final responsibility should go
to the information owner.