MENU
Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process?
A Common Control Provider plays the role of a monitor. The responsibilities of a Common Control
Provider are as follows:
Develops a continuous monitoring scheme for the assigned common controls.
Takes part in the organization's configuration management process.
Establishes a stock of components associated with the common controls.
Performs security impact analysis on the changes that affect the common controls.
Performs security assessments of the common security controls.
Creates and submits security status reports to the defined organizations.
Updates critical security documents and provides it to information system owners and other leaders.
Performs remediation activities to maintain current authorization status.
Answer option A is incorrect. The Chief Information Officer (CIO), or Information Technology (IT)
director, is a job title commonly given to the
most senior executive in an enterprise responsible for the information technology and computer
systems that support enterprise goals. The CIO plays the role of a leader and reports to the chief
executive officer, chief operations officer, or chief financial officer. In military organizations, they
report to the commanding officer.
Answer option B is incorrect. An Authorizing Official plays the role of an approver. The
responsibilities of an Authorizing Official are as follows:
Ascertains the security posture of the organization's information system.
Reviews security status reports and critical security documents.Determines the requirement of
reauthorization and reauthorizes information systems when required.
Answer option D is incorrect. A Senior Agency Information Security Officer plays the role of a
coordinator. The responsibilities of a Senior Agency Information Security Officer are as follows:
Establishes and implements the organization's continuous monitoring program.
Develops organizational guidance and configuration guidance for continuous monitoring of
information systems and organization's information technologies respectively.
Consolidates and analyzes Plans of Action and Milestones (POAM) to decide organizational security
weakness and inadequacy. Develops automated tools to support security authorization and
continuous monitoring.Provides training on the organization's continuous monitoring process.
Provides help to information system owners to develop and implement continuous monitoring.