The primary role of a data custodian in the risk management process is to ensure that data is protected according to the classification. A data custodian is a person or entity that has theresponsibility for implementing and maintaining the security controls for the data, such as access rights, encryption, backup, or disposal. A data custodian acts as an agent of the dataowner, who is the person or entity that has the authority and accountability for the data. A data custodian should ensure that data is protected according to the classification, which is the process of assigning a level of sensitivity and criticality to the data, based on the impact of its loss, disclosure, or modification. Data classification helps to determine the appropriate security controls and risk responses for the data, and to comply with the relevant laws, regulations, or contractual obligations. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.2.1, page 1271