Two divisions accept incompatible levels of customer-data exposure. No enterprise risk appetite is documented. Who should approve the common direction?

1. The security operations analyst
2. The external penetration tester
3. The governing body or appropriately delegated senior leadership
4. The software supplier