evsjv‡`k †M‡RU, AwZwi³, GwcÖj 6, 2014 12555 (12) While classifying information asset, it is recommended to check compliance with government laws and regulations. The agency may decide to have its own way of classification with more or less number of levels. But it is the most important job of an agency to analyze their information and define the states and classification. Accordingly, the agency shall impose security controls. (13) Information Owner The Information owner is a functional owner responsible for ensuring information classification with different state, proper controls to address confidentiality, integrity, authenticity and availability of information. Information owner has authority and responsibility for controlling production, development, maintenance; using security controls over the asset; placing appropriate level of protection; reviewing the information classification, security controls, access restrictions periodically for making cost-benefit decisions essential to ensure accomplishment of organizational mission objectives. (14) Information Custodian The Information custodian is a person designated by the owner to be responsible for protecting information by maintaining safeguards and controls established by the owner; he will take prior approval if necessary before sharing information. A custodian is also responsible to perform regular backup and data validity testing activities, data restoration from backups periodically, implement access control as defined by information owner. One custodian should be assigned for each information asset. The custodian remains ultimately responsible for the security of the asset and should be able to determine that any delegated responsibility has been discharged correctly. (15) Roles and responsibilities Agencies are responsible and accountable for appropriately safeguarding the information assets in their custody. Agencies are best able to gauge the significance and worth of their information assets, the risks to them and the appropriate measures to safeguard them. The approach is to achieve and maintain appropriate protection of organizational assets. To accomplish this goal, all assets should be accounted for and have a nominated owner. Owners should be identified for all assets and the responsibility for the maintenance of appropriate controls should be assigned. The information/asset owner has the responsibility to define the classification of information/asset, periodically review it, and ensure that it is kept up to date and at the appropriate level of security controls. The implementation of specific controls may be delegated by