During a stakeholder meeting, a question was asked regarding who is ultimately accountable for the protection of sensitive data. Assuming that all of the following roles exist in the enterprise, which would be the MOST appropriate answer?

ISACA CISM Exam syllabus in brief:

Information Security Governance    
A. Enterprise Governance
B. Information Security Strategy

Information Security Risk Management    
A. Information Security Risk Assessment
B. Information Security Risk Response

Information Security Program    
A. Information Security Program Development
B. Information Security Program Management

Incident Management    
A. Incident Management Readiness
B. Incident Management Operations