Who is ultimately responsible for security control of an asset?