Objective 5.1: Summarize elements of effective security governance
Security+ SY0-701 practice question
At a hospital, the director of patient services decides who may access the patient records system and how its data is classified. A database administrator employed by the hospital performs the nightly backups, maintains the database encryption, and grants access only after the director approves each request. Which role BEST describes the database administrator?
- Data owner
The director is the data owner, because the director decides classification and approves access. The administrator only carries out those decisions.
- Data controller
A data controller is the organization (here, the hospital itself) that determines the purposes and means of processing personal data. It is not an individual employee who runs backups.
- Data processor
A data processor is a separate organization, such as a cloud or billing provider, that processes personal data on the controller's behalf. The administrator is the hospital's own employee.
- Data custodian(Correct)
Correct. Performing backups, maintaining encryption, and implementing approved access are custodian duties: the administrator protects and maintains the data according to the owner's decisions.
Explanation
The data owner is a senior business role that is accountable for a data set: it decides its classification and who may access it. The data custodian handles the day-to-day technical care of the data, such as backups, encryption, and applying the access decisions the owner makes. Data controller and data processor are privacy-law roles that describe organizations: the controller decides why and how personal data is processed, and the processor processes it on the controller's behalf.