Which of the following persons in an organization is responsible for rejecting or accepting the residual risk for a system?

The Information Systems Security Officer (ISSO) is responsible for the overall security of an information system but typically advises the DAA/AO, rather than accepting the residual risk themselves.

The Designated Approving Authority (DAA), also known as an Authorizing Official (AO) in current NIST terminology, is the senior management official who makes the final decision to authorize an information system to operate and explicitly accepts the residual risk of operating that system. This role involves balancing mission needs with security posture.

The System Owner is responsible for the development, deployment, and maintenance of the system, including ensuring security requirements are met, but the final risk acceptance rests with the DAA/AO.

The Chief Information Security Officer (CISO) is responsible for the overall information security program of the organization and provides guidance, but usually does not accept residual risk for specific systems unless they are also the DAA/AO for that system, which is not their primary role.