Who is responsible for securing an information system, managing all security aspects of the system, and assembling the security accreditation package while serving as the point of contact for the…

The Information System Owner has overall programmatic responsibility for the system but typically delegates the day-to-day security management tasks to the ISSO.

The Information System Security Officer (ISSO) is the individual responsible for managing all security aspects of an information system, ensuring its security posture, and serving as the primary point of contact for the security control assessor during the accreditation process. The ISSO also plays a key role in developing and maintaining the system's security plan and assembling the security accreditation package.

A Common Control Provider (CCP) is responsible for implementing and managing common security controls that are inherited by multiple information systems, not the entire system's security.

An Information System Security Engineer primarily focuses on designing, developing, and implementing security solutions and architectures, rather than managing all security aspects or the accreditation package.