CGRC · Question #622
Under key roles in Continuous Monitoring; the __________ acts under authority of the system owner to monitor security posture of system & immediately reports discrepancies to system owner. Response:
The correct answer is A. ISSO. The Information System Security Officer (ISSO) is responsible for monitoring a system's security posture and reporting discrepancies to the system owner under Continuous Monitoring. This role ensures ongoing security compliance and timely identification of issues.
Question
Under key roles in Continuous Monitoring; the __________ acts under authority of the system owner to monitor security posture of system & immediately reports discrepancies to system owner. Response:
Options
- AISSO
- BCISO
- CAODR
- DISO
How the community answered
(46 responses)- A87% (40)
- B4% (2)
- C2% (1)
- D7% (3)
Why each option
The Information System Security Officer (ISSO) is responsible for monitoring a system's security posture and reporting discrepancies to the system owner under Continuous Monitoring. This role ensures ongoing security compliance and timely identification of issues.
The ISSO (Information System Security Officer) acts under the authority of the system owner, serving as the principal advisor for all security matters related to a specific information system. A core duty involves continuously monitoring the system's security posture and promptly reporting any discrepancies or incidents to the system owner.
A CISO (Chief Information Security Officer) holds a senior executive role focusing on an organization's overall information security strategy, rather than specific system-level monitoring and reporting to a system owner.
AODR (Authorizing Official Designated Representative) acts on behalf of the Authorizing Official but is not primarily tasked with continuous security posture monitoring and reporting for individual systems.
While an ISO (Information Security Officer) is a general term, the ISSO specifically denotes the system-level responsibility for continuous monitoring and reporting to the system owner within the context of information systems.
Concept tested: Roles in continuous monitoring
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-137.pdf
Topics
Community Discussion
No community discussion yet for this question.