Roles

Front 1

Chief Information Officer (CIO)

Back 1

Overall responsibility for the execution of the org security program

Front 2

Chief Information Officer (CIO)

Back 2

Delegate’s authority to the CISO for management of the enterprise system authorization program.

Front 3

Chief Information Officer (CIO)

Back 3

Supports through oversight, maintaining visibility.

Front 4

Chief Information Officer (CIO)

Back 4

Assists senior agency officials with their security responsibly.

Front 5

Chief Information Officer (CIO)

Back 5

Develops and maintains information security policies, procedures, and control techniques to address system security planning

Front 6

Chief Information Officer (CIO)

Back 6

Manages the identification, implementation, and assessment of common security controls

Front 7

Chief Information Officer (CIO)

Back 7

Identifies and coordinates common security controls for the agency

Front 8

Chief information Security Officer (CISO)

Back 8

Serves as the senior information security officer (SISO) as required by FISMA.

Front 9

Chief information Security Officer (CISO)

Back 9

Primary responsibility is information security overall responsibility such as risk management, policy development and compliance monitoring, security awareness, incident investigation and reporting and contingency planning.

Front 10

Chief information Security Officer (CISO)

Back 10

Charged with responsibility for the enterprise wide system authorization program

Front 11

Chief information Security Officer (CISO)

Back 11

Should document a many system authorizations positions as possible

Front 12

Chief information Security Officer (CISO)

Back 12

Overseeing personnel with significant responsibilities for information security and ensuring that the personnel are adequately trained

Front 13

Chief information Security Officer (CISO)

Back 13

Reporting annually to the head of the federal agency on the overall effectiveness of the organization’s information security program, including progress of remedial actions

Front 14

Chief information Security Officer (CISO)

Back 14

Information systems are covered by approved security plans and are authorized to operate

Front 15

Chief information Security Officer (CISO)

Back 15

There is centralized reporting of appropriate information security-related activities

Front 16

Chief information Security Officer (CISO)

Back 16

Information security-related activities required across the organization are accomplished in an efficient, cost-effective, and timely manner

Front 17

Senior Information Security Officer (SISO)

Back 17

Carrying out the chief information officer (CIO) security responsibilities under FISMA

Front 18

Senior Information Security Officer (SISO)

Back 18

Serving as the primary liaison for the chief information officer

Front 19

Senior Information Security Officer (SISO)

Back 19

Possesses professional qualifications, including training and experience, required to administer the information security program functions;

Front 20

Senior Information Security Officer (SISO)

Back 20

Maintains information security duties as a primary responsibility

Front 21

Senior Information Security Officer (SISO)

Back 21

Heads an office with the mission and resources to assist the organization in achieving more secure information and information systems in accordance with the requirements in FISMA.
o may also serve as authorizing official designated representatives or security control assessors

Front 22

Information System Owner (ISO)

Back 22

Develops the system security plan

Front 23

Information System Owner (ISO)

Back 23

Responsibility for the security of an information system.

Front 24

Information System Owner (ISO)

Back 24

Establishes the sensitivity level

Front 25

Information System Owner (ISO)

Back 25

Establishes the basis for the kinds of controls needed to protect

Front 26

Information System Owner (ISO)

Back 26

Over the full life cycle of the system

Front 27

Information System Owner (ISO)

Back 27

Ensures controls are implemented, requests resources to ensure implementation is accomplished

Front 28

Information System Owner (ISO)

Back 28

Continued effective of day to day controls

Front 29

Information System Owner (ISO)

Back 29

Remediation of weaknesses

Front 30

Information System Owner (ISO)

Back 30

Initiates system authorization activities

Front 31

Information System Owner (ISO)

Back 31

Monitors preparation of the accreditation package

Front 32

Information System Owner (ISO)

Back 32

Relationship between owners of the major application and the General support system owners must be close and well defined.

Front 33

Information System Owner (ISO)

Back 33

serves as the focal point for the information system

Front 34

Information System Owner (ISO)

Back 34

Updates the system security plan whenever a significant change occurs

Front 35

Information System Owner (ISO)

Back 35

Ensures that system users and support personnel receive the requisite security training

Front 36

Information System Owner (ISO)

Back 36

Maintains the system security plan and ensures that the system is deployed and operated according to the agreed-upon security requirements.

Front 37

Information System Security Officer (ISSO)

Back 37

Works in close collaboration with the information system owner.

Front 38

Information System Security Officer (ISSO)

Back 38

Responsible for securing the system and managing all security aspects of the system.

Front 39

Information System Security Officer (ISSO)

Back 39

monitors the effectiveness of the controls

Front 40

Information System Security Officer (ISSO)

Back 40

Serves as a principal advisor on all matters, technical and otherwise, involving the security

Front 41

Information System Security Officer (ISSO)

Back 41

Has the detailed knowledge and expertise required to manage the security aspects of an information system

Front 42

Information System Security Officer (ISSO)

Back 42

Controls security mechanisms, performs security activities and tasks, Develops and enforces security mechanisms, procedures for the system, follows up on incidents and advises the system owner of security related matters

Front 43

Information System Security Officer (ISSO)

Back 43

Plays the most important role in the certification of the system by being the POC for the certifying agent and assembling the security accreditation package.

Front 44

Information System Security Officer (ISSO)

Back 44

Assigned responsibility for the day-to-day security operations of a system

Front 45

Information System Security Officer (ISSO)

Back 45

Assists the senior agency information security officer in the identification, implementation, and assessment of the common security controls

Front 46

Information System Security Officer (ISSO)

Back 46

Plays an active role in developing and updating the system security plan as well as coordinating with the information system owner any changes to the system and assessing the security impact of those changes

Front 47

Security Control Assessor (SCA)

Back 47

Independent authority charged with assessing the security controls

Front 48

Security Control Assessor (SCA)

Back 48

Prior to initiating the security control assessment, an assessor conducts an assessment of the security plan

Front 49

Security Control Assessor (SCA)

Back 49

Determines if they are implemented correctly or operating as intended and produce outcome desired

Front 50

Security Control Assessor (SCA)

Back 50

Provides an assessment of the severity of weaknesses or deficiencies discovered and recommends corrective action to reduce or eliminate vulnerabilities to ensure independence

Front 51

Security Control Assessor (SCA)

Back 51

information system owner and common control provider rely on the security expertise and the technical judgment of the assessor

Front 52

Security Control Assessor (SCA)

Back 52

Prepare the final security assessment report containing the results and findings from the assessment.

Front 53

Authorizing Official (AO)

Back 53

Senior management official responsible for deciding if a system should be allowed receive an ATO.

Front 54

Authorizing Official (AO)

Back 54

Responsible for accepting any residual risks

Front 55

Authorizing Official (AO)

Back 55

Executive who has the authority and ability to evaluate a systems security risks

Front 56

Authorizing Official (AO)

Back 56

Oversight of the business process and required to determine the acceptable level of risk to the agency.

Front 57

Authorizing Official (AO)

Back 57

Typically have budgetary oversight for an information system or are responsible for the mission and/or business operations supported by the system

Front 58

Authorizing Official (AO)

Back 58

accountable for the security risks associated with information system operations

Front 59

Authorizing Official (AO)

Back 59

approve security plans, memorandums of agreement or understanding, and plans of action and milestones and determine whether significant changes in the information systems or environments of operation require reauthorization

Front 60

Authorizing Official (AO)

Back 60

coordinate their activities with interested parties during the security authorization process

Front 61

Approving Authority Designated Representative (AODR)

Back 61

Empowered to make decisions regarding the planning and resourcing of the effort, acceptance of the SSP.

Front 62

Approving Authority Designated Representative (AODR)

Back 62

Acts on behalf of an authorizing official to coordinate and conduct the required day-to-day activities associated with the security authorization process

Front 63

Approving Authority Designated Representative (AODR)

Back 63

may also be called upon to prepare the final authorization package

Front 64

Approving Authority Designated Representative (AODR)

Back 64

Determination of the risk to agency assets

Front 65

Approving Authority Designated Representative (AODR)

Back 65

Preparing accreditation decision memo

Front 66

Approving Authority Designated Representative (AODR)

Back 66

The only activity that cannot be delegated to the designated representative by the authorizing official is the authorization decision and signing of the associated authorization decision document

Front 67

Information Owner/Custodian/Steward

Back 67

Owner of the information processed by the information systems

Front 68

Information Owner/Custodian/Steward

Back 68

Ensures the system owner is aware of the requirements for protecting the system

Front 69

Information Owner/Custodian/Steward

Back 69

Most often information owner and system owner are the same person

Front 70

Information Owner/Custodian/Steward

Back 70

Provide input to information system owners regarding the security requirements and security controls for the systems where the information is processed, stored, or transmitted

Front 71

Information Owner/Custodian/Steward

Back 71

Organizational official with statutory, management, or operational authority for specified information and the responsibility for establishing the policies and procedures governing its generation, collection, processing, dissemination, and disposal

Front 72

Information Owner/Custodian/Steward

Back 72

Establishes the rules for appropriate use and protection of the subject data/information (rules of behavior)

Front 73

Information Owner/Custodian/Steward

Back 73

Decides who has access to the information system and with what types of privileges or access rights

Front 74

Information Owner/Custodian/Steward

Back 74

Assists in the identification and assessment of the common security controls where the information resides

Front 75

Head of Agency of Chief Executive Officer

Back 75

Highest-level senior official responsible

Front 76

Head of Agency of Chief Executive Officer

Back 76

Ensures integration of information security management processes with strategic and operational planning processes

Front 77

Head of Agency of Chief Executive Officer

Back 77

Ensures there are sufficient trained personnel available to ensure compliance with internal and external security requirements

Front 78

Head of Agency of Chief Executive Officer

Back 78

Establishes appropriate accountability for information security and provides active support and oversight of monitoring and improvement for the information security program

Front 79

Head of Agency of Chief Executive Officer

Back 79

Senior leadership commitment to information security establishes a level of due diligence within the organization that promotes a climate for mission and business success

Front 80

Risk Executive (Function)

Back 80

Ensures risk for individual systems are considered from an organization –wide perspective, overall strategic goals and objectives

Front 81

Risk Executive (Function)

Back 81

Ensures that management of system related security risks is consistent across the organization

Front 82

Risk Executive (Function)

Back 82

Reflects the Orgs risk tolerance level

Front 83

Risk Executive (Function)

Back 83

Provide a comprehensive, organization-wide, holistic approach for addressing risk

Front 84

Risk Executive (Function)

Back 84

Develop a risk management strategy for the organization providing a strategic view

Front 85

Risk Executive (Function)

Back 85

Facilitate the sharing of risk-related information among authorizing officials

Front 86

Risk Executive (Function)

Back 86

Provide oversight for all risk management-related activities

Front 87

Risk Executive (Function)

Back 87

Ensure that authorization decisions consider all factors necessary for mission and business success

Front 88

Risk Executive (Function)

Back 88

Promote cooperation and collaboration among authorizing officials

Front 89

Common Control Provider (CCP)

Back 89

Responsible for the development, implementation, assessment, monitoring and documenting common controls

Front 90

Common Control Provider (CCP)

Back 90

Ensures assessors, document findings of assessment and maintain a plan of action and milestones for all controls with weaknesses.

Front 91

Information security Architect (ISA)

Back 91

Ensures information security requirements are properly address in the orgs enterprise architecture

Front 92

Information security Architect (ISA)

Back 92

Liaison between the enterprise architect and information system security engineer

Front 93

Information security Architect (ISA)

Back 93

Coordinates with other roles about the system boundary and on a range of security-related issues

Front 94

Information System Security Engineer (ISSE)

Back 94

Captures and refines information security requirements and ensures there are integrated in to information technology products and systems by means of architecture, design, development and configuration.

Front 95

Information System Security Engineer (ISSE)

Back 95

Supports development team activities, designed and development

Front 96

Common Control Provider (CCP)

Back 96

Make security documentation available to system owners whose systems inherit common controls