[References: The CISM Review Manual 2023 states that “the data owner is responsible for defining the access privileges for each user role” and that “the data owner should ensure that the principle of least privilege is applied to all users” (p. 82). The CISM Review Questions, Answers & Explanations Manual 2023 also provides the following rationale for this answer: “Defining access privileges based on user roles is the best approach because it allows the data owner to assign the minimum level of access required for each role and to review and update the roles periodically” (p. 23)., , , , , , , , , ]