The best way to address the risk associated with new IT investments is to integrate security requirements at the beginning of projects. This means that security is considered as a key factor in the planning, design, development and testing phases of IT projects. By doing so, organizations can ensure that security is built into the IT solutions, rather than added as an afterthought. This can help to prevent or reduce security vulnerabilities, breaches, incidents and costs. Integrating security requirements at the beginning of projects is also consistent with the IT risk management frameworks that recommend a proactive and preventive approach to IT risk management12. References := Proactive IT Risk Management in an Era of Emerging Technologies, IT Risk Management Process & Frameworks

Revalidating the organization's risk tolerance and re-aligning the retention policy is the best option to ensure the optimization of retention costs, because it can help the organization balance the trade-off between the benefits and costs of data retention. By revalidating the risk tolerance, the organization can identify the optimal level of data retention that minimizes the exposure to legal, regulatory, and operational risks, while also reducing the storage and management costs. By re-aligning the retention policy, the organization can ensure that the data retention practices are consistent with the risk tolerance and reflect the current business needs and objectives. A re-aligned retention policy can also help the organization comply with data retention laws and regulations, avoid unnecessary data hoarding, and improve data quality and accessibility. References
:= Data Retention Policy 101: Best Practices, Examples & More - Intradyn, Data Retention 101: Policies and Best Practices | Egnyte, Best Practices for Data Retention and Policy Creation Will Optimize Storage Management, Data Retention Policy: Crafting Strategy for Compliance and Access

An independent assessment is a review by a third party of an authorization decision, a product, a service, or a system to verify its quality, functionality, compliance, or performance. An independent assessment can help identify and mitigate potential risks, errors, or defects before they cause problems or failures. An independent assessment can also provide an objective and unbiased opinion on the suitability and effectiveness of a solution for a specific purpose or context.
By requiring an independent assessment of solutions prior to implementation, the enterprise can ensure that the solutions meet the functional requirements and specifications, as well as the security and privacy standards and policies. This can prevent issues such as the malfunctioning of role-based access control, which could compromise the confidentiality, integrity, and availability of sensitive data. An independent assessment can also help evaluate the compatibility and interoperability of solutions with existing systems and processes, and provide recommendations for improvement or optimization.
Some examples of independent assessment methods are:
Independent verification and validation (IV&V): A process that checks whether a system meets its defined requirements and specifications, and whether it fulfills its intended purpose and functions.
Independent technical review (ITR): A process that evaluates the technical aspects of a system, such as its design, architecture, performance, reliability, security, usability, maintainability, and scalability.
Independent security assessment (ISA): A process that assesses the security posture of a system, such as its vulnerability to threats, its compliance with security standards and regulations, its implementation of security controls and measures, and its response to security incidents.

This is because an information steward is a person or group who is accountable for the quality, integrity, and usability of the information assets within a specific domain or function1. The responsibilities of an information steward include the following1:
Defining and enforcing data quality standards, policies, and procedures Monitoring and measuring data quality performance and outcomes Identifying and resolving data quality issues and errors Collaborating with data owners, custodians, analysts, and users to ensure data quality alignment and improvement Educating and training data stakeholders on data quality best practices and tools An information steward plays a key role in ensuring that the information assets are accurate, complete, consistent, reliable, and fit for purpose1.
The other options, information custodian, information analyst, and information owner are not directly responsible for information quality. They are more involved in the creation, storage, access, and use of information assets, rather than their quality2. They may also have different perspectives and interests than the information steward regarding the information quality. For example, the information custodian may focus on the security and availability of information assets, while the information analyst may focus on the analysis and interpretation of information assets. The information owner may focus on the value and benefits of information assets. Therefore, they may not have the same authority or responsibility as the information steward for ensuring information quality. References := What Is an Information Steward? | Informatica, Data Roles: Data Owner vs Data Steward vs Data Custodian

Section: Volume A