According to RMF which role has a primary responsibility to report the security status of the information system to the AO & other appropriate organizational officials on an ongoing basis IAW…

A Common Control Provider (CCP) is responsible for providing common security controls and related documentation, not primarily for reporting the ongoing security status of a specific system.

According to the NIST Risk Management Framework (RMF), the ISSO is responsible for ensuring the implementation of security controls, maintaining security documentation, and performing ongoing security monitoring activities, including reporting the security status of the information system to the AO and other stakeholders in accordance with the monitoring strategy.

An Independent Assessor evaluates the security controls but is not responsible for ongoing status reporting once the system is operational.

A Senior Information Assurance Officer (SIAO) typically has broader programmatic oversight, not the primary, day-to-day responsibility for reporting a specific system's security status.