Reilly is performing a security audit for a customer and finds several cases where users gained access to data without a formal access approval procedure. Reilly recommends a formal access approval process to fix the issue. Which role should he list that approves policies for users to gain access to data?

Domain 2: Asset Security Practice Questions
Questions from the following topics are included in this domain:
Identifying and classifying assets
Provisioning resources securely
Managing the data lifecycle
Security controls and compliance
Asset management
Data protection methods