Which of the following is not a responsibility of an information owner?

A.
Ensuring that the necessary security controls are in place

B.
Ensuring that proper access rights are being used and configuring them properly

C.
Defining security requirements per classification and backup requirements

D.
Approving any disclosure activities

Explanation:
Ensuring that proper access rights are being used and configuring them
properly would NOT be one of the responsibilities of the data owner. The data
custodian would implement the controls.