The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about

Question

Options

• AAn ISSE manages the security of the information system that is slated for Certification &
• BAn ISSE provides advice on the impacts of system changes.
• CAn ISSE provides advice on the continuous monitoring of the information system.
• DAn ISSO manages the security of the information system that is slated for Certification &
• EAn ISSO takes part in the development activities that are required to implement system changes.

• A
  2% (1)
• B
  90% (37)
• E
  7% (3)

Explanation

ISSE (advisor/engineer) advises on technical security matters - including the security impacts of system changes (B) and how to continuously monitor the system (C) - while ISSO (supporter/officer) manages the day-to-day security posture of the system through the Certification & Accreditation (C&A) process (D). Option A is wrong because management of the system's security belongs to the ISSO, not the ISSE - the ISSE only advises. Option E is wrong because participating in development activities to implement changes is an engineering/ISSE function, not the ISSO's operational management role; attributing it to ISSO conflates the two positions.

Memory tip: Use the last letter of each acronym - ISSE ends in E for Engineer, so they advise on engineering concerns (changes, monitoring); ISSO ends in O for Officer, so they manage and own the security posture. Advisor ≠ Manager, Engineer ≠ Officer.

No community discussion yet for this question.