Section: INFORMATION SECURITY GOVERNANCE

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

Security responsibilities of data custodians within an organization include ensuring that appropriate security measures are maintained and are consistent with organizational policy. Executive management holds overall responsibility for protection of the information assets. Data owners determine data classification levels for information assets so that appropriate levels of controls can be provided to meet the requirements relating to confidentiality, integrity and availability. Implementation of information security in products is the responsibility of the IT developers.