Reddit reviews CISSP Study Guide

I work in healthcare and have had trouble trying to get department managers completely on board but I have gotten to take over a handful of things IT used to do. The way I explained it to my CEO is that data owners are responsible for the who has access to the data and how they access it. Data custodians (IT) are the ones that make sure the data is available and that it gets backed up.

IT used to be both data owners and custodians. I explained to my CEO that IT doesn't know Sally needs (or doesn't need) access to the billing department's file share. It is up to management within that department to make that determination. If it is left to IT a lot of people could end up having access to data they don't need access to. I never really came up with an analogy.

This is covered in the "Information Security Governance and Risk Management" of the CISSP exam. Shon Harris's all-in-one exam book covers it pretty well. Eric Conrad also has a study guide. It does a very good job of explaining the CISSP concepts.

I'm not sure if that is exactly what you're looking for but there it is.