Question 850
Accountability for work to check authorized sharing channels and permitted purpose before release is disputed following a finding of improper disclosure through a partner request. The owner must have control over execution. Where should primary ownership for resolving the weakness sit?
Explanation
Correct Answer
In assessing the need to check authorized sharing channels and permitted purpose before release, primary accountability belongs with the function able to execute the described process repair. Here that means ensuring the responsible team can check authorized sharing channels and permitted purpose before release, with the result demonstrated by approved request basis and recipient-access audit trail and challenged by appropriate assurance functions.
Incorrect Answers
Given the contrast between improper use of confidential investigative information in an RFI and improper disclosure through a partner request as the distinguishing point, that group is suited to producing approved information request and restricted intelligence segregation for another control issue. In the present case ownership must support measures to check authorized sharing channels and permitted purpose before release and closure of improper disclosure through a partner request, not an unrelated assurance task.
This function has a remit connected with the duty to authenticate the request and produce only lawfully responsive records, and the associated problem is overbroad response to compulsory legal process. The current repair requires the responsible team to check authorized sharing channels and permitted purpose before release, so it should not be allocated to a team without direct control over that work.
Its normal responsibility would be addressing tipping-off risk through customer communication. It may advise or review here, but the accountable execution of measures to check authorized sharing channels and permitted purpose before release belongs in the process identified by this case.