Data Ownership vs Stewardship in Security Roles

SY0-701 By islever Editorial Last updated

Summarize fundamental security concepts.

Short answer

A The Data Owner is responsible for identifying risks associated with the data and determining who has appropriate access to it.

Question

Which of the following data roles is responsible for identifying risks and appropriate access to data?
  1. Owner Correct Answer
  2. Custodian
  3. Steward
  4. Controller

Key Takeaways

The common trap is confusing the strategic authority of the Owner with the tactical governance duties of the Steward; remember that 'responsibility' in this context often implies ultimate accountability.

This question tests the distinction between Data Owner and Data Steward roles. The correct answer is A (Owner) because the Owner holds accountability for risk identification and access authorization.

Common mistake: Many learners select C (Steward) because stewards manage data quality and access controls, but they do so based on policies defined by the Owner, not by identifying risks or authorizing access themselves.

Expert Analysis

Why the Answer Is Correct

In security frameworks like NIST SP 800-122 and general data governance standards, the Data Owner is the senior official accountable for the data asset. This role is responsible for classifying the data, identifying risks associated with it, and determining who has appropriate access rights. The Owner defines the security policy, making them the primary entity for risk and access decisions.

Why the Other Options Are Wrong

Custodians (B) implement the controls and perform day-to-day maintenance as directed by the Owner. Stewards (C) ensure data quality and compliance with policies but typically operate under the guidance of the Owner. Controllers (D) are a privacy law term (e.g., GDPR) rather than a standard operational security role in this specific context, and even then, ownership concepts map closely to controllership, but "Owner" is the standard ISACA/CompTIA terminology for this function.

Community Comment Notes

The community majority correctly identified A. As user jbmac noted, the Owner determines access and identifies risks. However, some users like Hayder81 argued for Steward, citing oversight duties, but this conflates governance execution with ultimate accountability.

Exam Strategy

When distinguishing between Owner and Steward, focus on 'Accountability' vs 'Execution'. The Owner is accountable for the 'What' and 'Who' (Risk & Access), while the Steward/Custodian handles the 'How' (Quality & Implementation).

Frequently Asked Questions

Why isn't the Data Steward responsible for access?

Stewards manage data quality and ensure policies are followed, but the Owner defines those policies and authorizes access.

What is the difference between Owner and Custodian?

Owners define security requirements and access rules; Custodians implement technical controls and maintain the data daily.

More SY0-701 FAQ →

Community Votes

A
71%
C
29%

71% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 17 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 17

  1. a4e15bd 👍 26
    A. Owner The data owner is indeed responsible for identifying risks and determining the appropriate access to data.
  2. jbmac 👍 5 Answered A
    The correct answer is: A. Owner Explanation: The data owner is responsible for determining the appropriate access to data and identifying the risks associated with it. The data owner typically defines the security and access control policies for data within an organization. This role ensures that data is managed in accordance with organizational policies and compliance requirements, and identifies risks related to the data’s confidentiality, integrity, and availability.
  3. Hayder81 👍 4
    C. Steward Data Steward: Oversees data governance policies, ensures data quality, manages access control, and helps in identifying risks to ensure proper use of data.
  4. 9149f41 👍 3 Answered A
    Owner: The data owner is responsible for identifying risks associated with the data and determining who has appropriate access to it. Owners make decisions about data classification, access controls, and usage policies. Custodian: Data custodians are responsible for the day-to-day maintenance and protection of data based on the rules set by the owner. They implement access controls, backup procedures, and security measures but do not decide who should access the data. The data owner is ultimately accountable for the security and access decisions related to the data. They evaluate risks and establish the appropriate access controls to protect it. While Custodian is an important role in data management, it is not primarily responsible for identifying risks and determining appropriate access to data.
  5. saba263 👍 3 Answered A
    A. Owner The Owner of the data is responsible for identifying risks and determining appropriate access to the data. The data owner has the authority and accountability for defining who can access the data, what kind of access is allowed (e.g., read, write), and ensuring the data is protected according to organizational policies and compliance requirements. This role is crucial for data governance and risk management.
Show 12 more comments
  1. User92 👍 3 Answered C
    The data owner is typically responsible for the overall management of the data. A Data Steward is tasked with managing data quality, ensuring data governance policies are followed, and identifying risks related to data handling and access.
  2. opeyemi777 👍 3 Answered A
    Ensuring that adequate and timely risk identification and access to appropriate data is performed is the responsibility of the owner
  3. Murtuza 👍 2 Answered A
    Data Owners are accountable for the data within their domain, including defining access policies and managing risks associated with the data1. They ensure that data is used appropriately and securely.
  4. Ty13 👍 2 Answered A
    A. Owner The Data Owner is chiefly responsible for identifying risks related to the data and determining who should have access to it.
  5. e2ba0ff 👍 2 Answered A
    Data owner:A senior executive responsible for labeling information assets and ensuring they are protected with appropriate controls
  6. AndyK2 👍 1 Answered C
    I'd go with Steward. Owner: Overall accountability for data Custodian: Technical management and storage Controller: Determines purposes and means of data processing Controller is primarily used in European Law (GDPR) - according to the CompTIA book. While there's some overlap, the specific task of "identifying risks and appropriate access to data" aligns more closely with the Data Steward role. Custodians implement the technical controls, but Stewards define what those controls should be based on risk assessment.
  7. ProudFather 👍 1 Answered C
    A data steward is responsible for defining, maintaining, and communicating data policies and standards. This includes identifying risks associated with data and determining appropriate access controls to protect sensitive information.
  8. Frez 👍 1 Answered B
    Sounds like CUSTODIAN to me.... Data Custodian: Manages access controls and technical security measures to protect data
  9. famuza77 👍 1 Answered B
    this is weird, Data Custodian and Steward are the same think regarding videos on Youtube
  10. Chrisssy6111 👍 1
    A. Owner, data steward is just another name for data custodian that Comptia uses.
  11. apant 👍 3 Answered C
    C. Steward
  12. 9ef4a35 👍 3
    A. Owner

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide