Data Owner: Identifying Risks and Appropriate Access

SY0-701 By islever Editorial Last updated

Compare and contrast concepts and strategies to protect data.

Short answer

A The data owner identifies data risks and decides appropriate access, while the custodian implements controls and the steward handles data governance and quality.

Question

Which of the following data roles is responsible for identifying risks and appropriate access to data?
  1. Owner Correct Answer
  2. Custodian
  3. Steward
  4. Controller

Key Takeaways

It tests accountability versus execution in data governance: the owner authorizes access and owns risk, while custodians implement controls and stewards govern quality.

This SY0-701 question tests the distinction between data owner, custodian, steward, and controller. The correct role for identifying risks and deciding appropriate access is the data owner (A).

Common mistake: Choosing C (steward) because governance sounds like risk and access; stewards handle data quality and policy conformance, but the owner holds risk and access accountability.

Expert Analysis

Accountability versus execution. CompTIA's data-protection model separates the role that is accountable for a data set from the roles that operate controls. The data owner is the business or senior role with ultimate accountability: classifying the data, identifying the risks that apply, and deciding who gets which access. That maps directly to the question's decision-level wording about identifying risks and appropriate access, because both are authorization and risk-acceptance decisions rather than hands-on tasks.

Why the other roles do not fit. The custodian (B) implements and maintains the controls the owner approves, such as permissions, backups, encryption, and storage safeguards. The steward (C) focuses on governance and data quality, including policy conformance, definitions, and accuracy, and may recommend access rules, but does not hold ultimate risk and access accountability. The controller (D) is a privacy-law role, chiefly under GDPR, that determines the purposes and means of processing personal data; it is not the internal role that approves access to a data set. Comments on this item show the split: some learners argue for steward because it sounds governance-heavy, while others correctly note that the owner sets classification and access and the custodian implements.

Applying the criterion. The question asks for the role responsible for identifying risks and appropriate access. Risk identification and access approval are owner decisions. If the stem had asked who implements access control lists, performs backups, or maintains storage, the custodian would be correct. If it had asked who determines why and how personal data is processed under GDPR, controller would fit. Therefore A is the only role matching the decision-level wording.

Official Reference

https://www.comptia.org/certifications/security

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question uses verbs such as decides, approves, accountable, or identifies risk, map them to the owner; when it uses implements, maintains, backs up, or configures, map them to the custodian. Treat steward as data quality and policy governance, and controller as GDPR purpose-and-means processing. Eliminate options that describe execution or legal processing intent before selecting.

Frequently Asked Questions

Why is the data owner rather than the data steward responsible for access?

The owner holds accountability for the data set and approves risk tolerance and access. The steward supports governance and data quality but does not own those decisions.

What does a data custodian do in the Security+ data roles model?

The custodian implements and maintains the controls the owner approves, such as permissions, backups, encryption, and storage safeguards.

Is the data controller the same as the data owner?

No. Controller is a privacy-law role that determines the purpose and means of processing personal data, commonly under GDPR; owner is the internal accountable role for a data set.

More SY0-701 FAQ →

Discussion 21 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 21

  1. a4e15bd 👍 29
    A. Owner The data owner is indeed responsible for identifying risks and determining the appropriate access to data.
  2. jbmac 👍 7 Answered A
    The correct answer is: A. Owner Explanation: The data owner is responsible for determining the appropriate access to data and identifying the risks associated with it. The data owner typically defines the security and access control policies for data within an organization. This role ensures that data is managed in accordance with organizational policies and compliance requirements, and identifies risks related to the data’s confidentiality, integrity, and availability.
  3. Hayder81 👍 4
    C. Steward Data Steward: Oversees data governance policies, ensures data quality, manages access control, and helps in identifying risks to ensure proper use of data.
  4. 9149f41 👍 3 Answered A
    Owner: The data owner is responsible for identifying risks associated with the data and determining who has appropriate access to it. Owners make decisions about data classification, access controls, and usage policies. Custodian: Data custodians are responsible for the day-to-day maintenance and protection of data based on the rules set by the owner. They implement access controls, backup procedures, and security measures but do not decide who should access the data. The data owner is ultimately accountable for the security and access decisions related to the data. They evaluate risks and establish the appropriate access controls to protect it. While Custodian is an important role in data management, it is not primarily responsible for identifying risks and determining appropriate access to data.
  5. saba263 👍 3 Answered A
    A. Owner The Owner of the data is responsible for identifying risks and determining appropriate access to the data. The data owner has the authority and accountability for defining who can access the data, what kind of access is allowed (e.g., read, write), and ensuring the data is protected according to organizational policies and compliance requirements. This role is crucial for data governance and risk management.
Show 16 more comments
  1. User92 👍 3 Answered C
    The data owner is typically responsible for the overall management of the data. A Data Steward is tasked with managing data quality, ensuring data governance policies are followed, and identifying risks related to data handling and access.
  2. opeyemi777 👍 3 Answered A
    Ensuring that adequate and timely risk identification and access to appropriate data is performed is the responsibility of the owner
  3. apant 👍 3 Answered C
    C. Steward
  4. 9ef4a35 👍 3
    A. Owner
  5. Murtuza 👍 2 Answered A
    Data Owners are accountable for the data within their domain, including defining access policies and managing risks associated with the data1. They ensure that data is used appropriately and securely.
  6. Ty13 👍 2 Answered A
    A. Owner The Data Owner is chiefly responsible for identifying risks related to the data and determining who should have access to it.
  7. e2ba0ff 👍 2 Answered A
    Data owner:A senior executive responsible for labeling information assets and ensuring they are protected with appropriate controls
  8. pchuu 👍 1 Answered A
    Straight from Google. The answer is Owner • The Data Owner identifies risks and defines access. Because they are senior business leaders (like a CFO or VP of Sales), they understand the business value of the information. They decide the intent: what the data classification should be, what level of risk the company can tolerate, and who legally has the right to see it. • The Data Steward manages day-to-day adherence. They act as the operational subject matter expert. They ensure the data's quality and meaning match the owner's intent, and they help translate high-level access policies into functional rules. (Note: In some narrow exam contexts or custom company frameworks, you may see a Steward tasked with flagging functional risks or reviewing access requests, but they do not hold the ultimate authority to set those access rules.) • The Data Custodian implements the access. The custodian (usually IT or a database administrator) has no say in who should have access or what the risks are. Their job is strictly to enforce the owner's decisions by implementing technical controls, managing encryption, and configuring the system permissions.
  9. AndyK2 👍 1 Answered C
    I'd go with Steward. Owner: Overall accountability for data Custodian: Technical management and storage Controller: Determines purposes and means of data processing Controller is primarily used in European Law (GDPR) - according to the CompTIA book. While there's some overlap, the specific task of "identifying risks and appropriate access to data" aligns more closely with the Data Steward role. Custodians implement the technical controls, but Stewards define what those controls should be based on risk assessment.
  10. 5a11b63 👍 1 Answered A
    The data owner is typically the person or entity accountable for a specific set of data. They are responsible for: Identifying risks associated with the data Defining access policies and determining who should have access Ensuring that data is handled in compliance with regulations and internal policies They make decisions about classification, protection, and usage of the data.
  11. Brian57 👍 1 Answered C
    Data custodian/steward – Responsible for data accuracy, privacy, and security • Works directly with the data – Associates sensitivity labels to the data – Ensures compliance with any applicable laws and standards – Manages the access rights to the data – Implements security controls
  12. oreinn 👍 1 Answered C
    The correct answer is C. Steward. A Data Steward is responsible for identifying risks and ensuring appropriate access to data. They oversee data governance, manage data quality, and enforce policies to protect data while ensuring it is accessible to authorized users.
  13. ProudFather 👍 1 Answered C
    A data steward is responsible for defining, maintaining, and communicating data policies and standards. This includes identifying risks associated with data and determining appropriate access controls to protect sensitive information.
  14. Frez 👍 1 Answered B
    Sounds like CUSTODIAN to me.... Data Custodian: Manages access controls and technical security measures to protect data
  15. famuza77 👍 1 Answered B
    this is weird, Data Custodian and Steward are the same think regarding videos on Youtube
  16. Chrisssy6111 👍 1
    A. Owner, data steward is just another name for data custodian that Comptia uses.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide