Which of the following tasks are not performed by a system owner per NIST SP 800-18?
A. Develops a system security plan
B. Establishes rules for appropriate use and protection of data
C. Identifies and implements security controls
D. Ensures that system users receive appropriate security training