As VP of Sales, Naomi is the data owner of a file that contains personally identifiable information (PII) about customers. She decides to run a report on the length of time the customers stay in the same house; that is, their address does not change. Naomi decides to build and generate this report in Excel on her desktop. In such a situation, what role is MOST likely assigned to Naomi?
1. Data Owner vs. Data Custodian (ISC² Core Model)
The ISC² CBK strictly separates high-level management decisions from day-to-day technical execution.
- Data Owner (Information Owner)
- Who they are: Executives or senior managers (e.g., VP of Sales, Chief Financial Officer).
- Core Duty: Ultimate corporate and legal responsibility for the data asset.
- Key Actions: Assigns data classifications, approves access requests, and defines retention policies.
- Exam Trap: The Data Owner never does hands-on technical work. If they do, they are creating a security risk.
- Data Custodian (System Administrator)
- Who they are: IT department, database administrators, or system engineers.
- Core Duty: Technical implementation and protection of the data as directed by the Owner.
- Key Actions: Running backups, configuring user permissions, encrypting files, and generating requested reports.
- Exam Trap: The Custodian does not decide who gets access; they only execute the access rules approved by the Owner.
2. ISC² Standard Roles vs. GDPR Legal Roles
The CISSP exam tests both traditional data governance roles and modern legal frameworks like the General Data Protection Regulation (GDPR). They map directly to each other but use different vocabulary:
| ISC² Traditional Role | GDPR Equivalent Role | Primary Metric / Focus |
|---|---|---|
| Data Owner | Data Controller | Determines the why and how data is used. Holds ultimate liability. |
| Data Custodian | Data Processor | Handles the actual technical manipulation, storage, and processing of the data. |
The Mapping Logic
- Data Owner → Data Controller: Your company’s VP of Sales decides why the customer data is collected (to track sales retention) and what rules apply to it. Legally, the company acts as the Controller.
- Data Custodian → Data Processor: If your company hires an external cloud provider (like AWS or Salesforce) to host that customer data, that external vendor acts as the Data Processor.
3. Why Thor Pedersen Flags it as a “Conflict of Interest”
In Thor’s specific practice question scenario, Naomi (Data Owner) is manually generating a PII report in Excel on her local desktop.
From a strict ISC² security perspective, this is a major Conflict of Interest / Separation of Duties violation:
- Bypassing Custodians: The Owner is acting as her own Custodian.
- Lack of Oversight: No one is auditing her local desktop to ensure the customer PII is secure, encrypted, or wiped after use.
- Audit Failure: If an administrative account or management role executes technical operations directly, it breaks the principle of least privilege and destroys clear accountability.
If you want, we can look at a few more practice scenarios to test your understanding of:
- How Data Controllers and Processors split liability during a data breach.
- Other classic Separation of Duties exam questions regarding developers and administrators.