nerdexam
(ISC)2

CGRC · Question #224

Who is primarily responsible for the development of the system-specific procedures (ISO, ISSO, IS Architect, Sys Admin)? Response:

The correct answer is A. Information systems security officer (ISSO). The Information Systems Security Officer (ISSO) holds primary responsibility for developing and maintaining system-specific security procedures within an organization.

Implementation of Security and Privacy Controls

Question

Who is primarily responsible for the development of the system-specific procedures (ISO, ISSO, IS Architect, Sys Admin)? Response:

Options

  • AInformation systems security officer (ISSO)
  • BSystem owner
  • CSystem architect
  • DSystem administrator

How the community answered

(26 responses)
  • A
    96% (25)
  • B
    4% (1)

Why each option

The Information Systems Security Officer (ISSO) holds primary responsibility for developing and maintaining system-specific security procedures within an organization.

AInformation systems security officer (ISSO)Correct

The Information Systems Security Officer (ISSO) is typically responsible for overseeing the information system's security posture, which includes the development and implementation of system-specific security procedures to ensure compliance with policies and regulatory requirements.

BSystem owner

A System Owner has overall responsibility for the system, including its security, but delegates the detailed development of security procedures to security specialists like the ISSO.

CSystem architect

A System Architect designs the system's structure and components, including security architecture, but usually does not develop detailed operational security procedures.

DSystem administrator

A System Administrator implements and operates the system according to established procedures but is not primarily responsible for developing those procedures.

Concept tested: ISSO responsibilities

Source: https://csrc.nist.gov/glossary/term/information-system-security-officer-isso

Topics

#ISSO responsibilities#System-specific procedures#Roles and responsibilities#Control implementation documentation

Community Discussion

No community discussion yet for this question.

Full CGRC Practice