Kimon is responsible for categorizing information systems in his organization. To whom will he delegate the selection of security controls, and who will be responsible for implementing them?

The data owner bears responsibility for categorizing information systems and delegates selection of controls to system owners, while custodians implement the controls. Users don't perform any of these actions, while business owners are tasked with ensuring that systems are fulfilling their business purpose.