Asset Owner
Definition
The person or role accountable for ensuring an asset is appropriately classified, protected, and reviewed. The owner is typically a business manager whose process depends on the asset, not the IT team. Owners accept residual risk after controls are applied. Custodians (usually IT or security) implement the controls the owner requires.
- Role type
- Business manager, not IT
- Accountable for
- Classification, protection, review of the asset
- Accepts
- Residual risk after controls are applied
- Distinct from
- Custodian, who implements the technical controls
Common questions
Who signs off when a control cannot fully eliminate a risk to an asset?+
The asset owner, not the custodian, formally accepts the residual risk. IT or security can recommend or implement controls, but the decision to proceed despite remaining exposure belongs to the business role accountable for the asset's process.
Can the IT department be an asset owner?+
Only for assets IT itself depends on for its own operations, such as internal infrastructure. For business systems, IT typically holds the custodian role, implementing controls the business-side owner specifies, rather than owning the risk decision.
Related terms
- Asset Inventory (Asset Register)
- A structured record listing every information asset in scope, together with its owner, custodian, physical or logical location, classification level, criticality rating,...
- Classification Tier
- A label assigned to an asset or data type indicating its sensitivity and the handling rules that apply. Common tiers are Public,...
- Information Asset
- Anything that has value to the organisation by virtue of the information it contains or the information function it performs. Includes data,...
- Threat
- A potential cause of an unwanted incident that could harm an asset. Threats may be natural (flood, fire), environmental (power failure), human...
- Vulnerability
- A weakness in an asset or in a control protecting that asset, which a threat could exploit to cause harm. Examples: an...