What does an ownership gap mean in an organization?

• A. Systems exist with no clear owner.
• B. All systems have owners but no responsibilities.
• C. Owners exist but do not review policies.
• D. There is a single owner for all systems.

Answer: (A)

An ownership gap means there is no clear owner assigned to a system or asset, leaving accountability for its security, maintenance, and risk decisions unclear. When systems exist without a designated owner, no one bears responsibility for approving changes, enforcing controls, monitoring compliance, or addressing vulnerabilities. This ambiguity allows risks to go unaddressed and complicates remediation and governance efforts.

If there were an owner but no defined responsibilities, or owners who simply don’t review policies, you’d see governance issues, but the fundamental gap is the absence of an accountable person or group. And having a single owner for all systems still provides clear ownership, just potentially overly centralized; it isn’t a gap in ownership itself.