CGRC · Question #300
Who plays the Central role in that he is responsible for system operation, implementation of security controls, and continuous monitoring. Response:
The correct answer is A. Information System Owner. The Information System Owner has primary responsibility for the day-to-day operation, security control implementation, and continuous monitoring of an information system.
Question
Who plays the Central role in that he is responsible for system operation, implementation of security controls, and continuous monitoring. Response:
Options
- AInformation System Owner
- BAuthorizing Official
- CIndustry Standard Architecture
- DInformation Systems Security Officer
How the community answered
(50 responses)- A92% (46)
- B2% (1)
- C2% (1)
- D4% (2)
Why each option
The Information System Owner has primary responsibility for the day-to-day operation, security control implementation, and continuous monitoring of an information system.
The Information System Owner has overall responsibility for the development, operation, and maintenance of an information system. This includes ensuring effective implementation of security controls, overseeing continuous monitoring activities, and managing the system's operational aspects throughout its lifecycle.
An Authorizing Official makes the formal decision to authorize a system's operation based on its acceptable risk, but does not typically handle the day-to-day operational or control implementation responsibilities.
Industry Standard Architecture refers to a set of commonly accepted design principles or structures within an industry, not a specific role responsible for system operation.
An Information Systems Security Officer advises the System Owner on security matters, but the ultimate responsibility for system operation and control implementation rests with the System Owner.
Concept tested: Roles and responsibilities in RMF - Information System Owner
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.