Who owns risk of unauthorized application data access?

CISM By islever Editorial Last updated

Short answer

C Application owner accepts accountability for unauthorized access risks.

Question

Of the following, who should own the risk associated with unauthorized access to application data?
  1. Data custodian
  2. Application developer
  3. Application owner Correct Answer
  4. Access administrator

Key Takeaways

This question tests the distinction between accountability (ownership) and execution (custodians/admins), often trapping those who confuse technical implementation with ultimate responsibility.

The application owner is accountable for the risk of unauthorized access to application data, as they define business requirements and sensitivity. Community consensus confirms this responsibility aligns with their oversight of the application's security posture.

Common mistake: Choosing Data custodian (A) is a common error because custodians implement security controls, but they do not own the business risk or define access requirements.

Expert Analysis

Why the Answer Is Correct

The application owner is accountable for the business process supported by the application. They are best positioned to understand the data's sensitivity and the impact of unauthorized access, making them the rightful owner of the risk. ISACA principles consistently assign risk ownership to the role with decision-making authority over the asset.

Why the Other Options Are Wrong

Data custodians implement technical controls but lack business authority. Application developers build the software but do not manage operational access or business risk. Access administrators configure permissions based on requirements provided by others, rather than owning the risk itself.

Community Comment Notes

Comments unanimously support option C, noting that the title implies responsibility. One user highlights that the owner understands business context and sensitivity, which is crucial for proper risk management.

Exam Strategy

Remember the RACI model distinctions for CISM: owners are accountable (risk), while custodians and admins are responsible for execution. Focus on who defines the 'why' and 'what' versus the 'how'.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Booict 👍 1
    C - The application owner is responsible for the overall management, security, and performance of the application. They understand the business context, data sensitivity, and access requirements. Owning the risk ensures proper controls, monitoring, and mitigation.
  2. ServerBrain 👍 1 Answered C
    C. Application owner
  3. fac161f 👍 1
    Its in the name

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Best Defense Against DDoS Attacks in Enterprise Networks?

S-grade

When Should a Business Continuity Plan Be Primarily Triggered?

S-grade

Which Approach Best Communicates Security to Senior Management?

S-grade

How to Keep a Business Continuity Plan Current?

S-grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide