Which of the following persons in an organization is responsible for rejecting or accepting the residual risk for a system?

Question

Options

• ASystem Owner
• BInformation Systems Security Officer (ISSO)
• CDesignated Approving Authority (DAA)
• DChief Information Security Officer (CISO)

• B
  3% (1)
• C
  91% (32)
• D
  6% (2)

Explanation

The Designated Approving Authority (DAA) - also called the Authorizing Official (AO) in modern NIST/RMF terminology - holds the formal authority to accept or reject residual risk on behalf of the organization, making them the one person legally accountable for the decision to operate a system despite known risks. The System Owner (A) manages the system and prepares the security documentation, but they don't have the authority to accept risk on behalf of the organization. The ISSO (B) implements and monitors security controls and advises on risk, but is a technical/advisory role without final approval authority. The CISO (C) sets policy and oversees the overall security program organization-wide, but risk acceptance for a specific system is delegated to the DAA - the CISO operates at a strategic level, not per-system authorization.

Memory tip: Think "DAA = Decision, Authority, Accountable." The DAA signs on the dotted line - if something goes wrong with that residual risk, they own it. When you see "accept residual risk" on an exam, that's always an authorization action, which belongs to the DAA/Authorizing Official.

No community discussion yet for this question.