nerdexam
(ISC)2

CGRC · Question #300

Who plays the Central role in that he is responsible for system operation, implementation of security controls, and continuous monitoring. Response:

The correct answer is A. Information System Owner. The Information System Owner has primary responsibility for the day-to-day operation, security control implementation, and continuous monitoring of an information system.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Who plays the Central role in that he is responsible for system operation, implementation of security controls, and continuous monitoring. Response:

Options

  • AInformation System Owner
  • BAuthorizing Official
  • CIndustry Standard Architecture
  • DInformation Systems Security Officer

How the community answered

(50 responses)
  • A
    92% (46)
  • B
    2% (1)
  • C
    2% (1)
  • D
    4% (2)

Why each option

The Information System Owner has primary responsibility for the day-to-day operation, security control implementation, and continuous monitoring of an information system.

AInformation System OwnerCorrect

The Information System Owner has overall responsibility for the development, operation, and maintenance of an information system. This includes ensuring effective implementation of security controls, overseeing continuous monitoring activities, and managing the system's operational aspects throughout its lifecycle.

BAuthorizing Official

An Authorizing Official makes the formal decision to authorize a system's operation based on its acceptable risk, but does not typically handle the day-to-day operational or control implementation responsibilities.

CIndustry Standard Architecture

Industry Standard Architecture refers to a set of commonly accepted design principles or structures within an industry, not a specific role responsible for system operation.

DInformation Systems Security Officer

An Information Systems Security Officer advises the System Owner on security matters, but the ultimate responsibility for system operation and control implementation rests with the System Owner.

Concept tested: Roles and responsibilities in RMF - Information System Owner

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#System Owner#Roles and Responsibilities#Accountability#Risk Management Framework (RMF)

Community Discussion

No community discussion yet for this question.

Full CGRC Practice