The risk associated with data loss from a website which contains sensitive customer information is best owned by the business process owner, as they are ultimately responsible for the business objectives and outcomes that depend on the website. The business process owner should ensure that the website is adequately protected and that the customer data is handled in compliance with the relevant laws and regulations. The third-party website manager, IT security, and the compliance manager are all involved in managing the risk, but they are not the owners. The third-party website manager is responsible for the technical aspects of the website, such as hosting, maintenance, and performance. IT security is responsible for implementing and monitoring the security controls and policies for the website. The compliance manager is responsible for ensuring that the website meets the regulatory and contractual requirements. However, none of these roles have the authority or accountability to own the risk, as they are not directly affected by the business impact of the data loss. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Identification, page 47.