Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process?

Question

Options

• AChief Information Officer
• BAuthorizing Official
• CCommon Control Provider
• DSenior Agency Information Security Officer

• A
  13% (4)
• B
  6% (2)
• C
  77% (24)
• D
  3% (1)

Explanation

Common Control Provider (C) is correct because this role is explicitly defined in NIST SP 800-37 (the Risk Management Framework) as responsible for the development, implementation, assessment, and ongoing monitoring of common (inherited) controls. As the owner of those controls, the Common Control Provider actively participates in configuration management to ensure the controls remain properly implemented and effective across all inheriting systems.

Why the distractors are wrong:

• A (CIO): The Chief Information Officer handles strategic IT governance and policy-not day-to-day monitoring within the configuration management process.
• B (Authorizing Official): The AO accepts organizational risk and grants system authorization (the ATO), but does not serve as a monitor in configuration management.
• D (SAISO): The Senior Agency Information Security Officer provides agency-wide security guidance and serves as a liaison-an advisory/oversight role, not a configuration management monitor.

Memory tip: Think of the Common Control Provider as the "landlord" of shared security controls-they built them, they rent them out to other systems, and they are responsible for keeping them in working order (monitoring). If something breaks, it's on them.

No community discussion yet for this question.