ISC2 Exam ISSEP Topic 3 Question 3 Discussion

A Common Control Provider plays the role of a monitor. The responsibilities of a Common Control

Provider are as follows:

Develops a continuous monitoring scheme for the assigned common controls.

Takes part in the organization's configuration management process.

Establishes a stock of components associated with the common controls.

Performs security impact analysis on the changes that affect the common controls.

Performs security assessments of the common security controls.

Creates and submits security status reports to the defined organizations.

Updates critical security documents and provides it to information system owners and other leaders.

Performs remediation activities to maintain current authorization status.

Answer option A is incorrect. The Chief Information Officer (CIO), or Information Technology (IT)

director, is a job title commonly given to the

most senior executive in an enterprise responsible for the information technology and computer

systems that support enterprise goals. The CIO plays the role of a leader and reports to the chief

executive officer, chief operations officer, or chief financial officer. In military organizations, they

report to the commanding officer.

Answer option B is incorrect. An Authorizing Official plays the role of an approver. The

responsibilities of an Authorizing Official are as follows:

Ascertains the security posture of the organization's information system.

Reviews security status reports and critical security documents.Determines the requirement of

reauthorization and reauthorizes information systems when required.

Answer option D is incorrect. A Senior Agency Information Security Officer plays the role of a

coordinator. The responsibilities of a Senior Agency Information Security Officer are as follows:

Establishes and implements the organization's continuous monitoring program.

Develops organizational guidance and configuration guidance for continuous monitoring of

information systems and organization's information technologies respectively.

Consolidates and analyzes Plans of Action and Milestones (POAM) to decide organizational security

weakness and inadequacy. Develops automated tools to support security authorization and

continuous monitoring.Provides training on the organization's continuous monitoring process.

Provides help to information system owners to develop and implement continuous monitoring.