A system owner is accountable for security throughout a system’s procurement, development, operation, and maintenance lifecycle. That includes incorporating security into purchasing and development decisions, ensuring that the overall set of controls provides adequate protection, and ensuring vulnerabilities are assessed and reported for response and data-owner awareness. NIST defines the system owner as responsible for system procurement, development, integration, operation, and maintenance, and requires the owner to ensure operation in accordance with selected and implemented controls.
Community Discussion