Finals Lesson 2 Part 1 Flashcards
This position is responsible for ensuring that the IAP is developed and implemented in accordance with regulatory and business requirements. The _____ plays a crucial role in allocating resources and fostering commitment to the IAP.
Chief Executive Officer (CEO)
In support of the IAP, the ______ ensures that the CIO and CISO positions are filled and appoints an Authorizing Official (AO) and Information System Owner (ISO) for each information system.
Chief Executive Officer (CEO)
The ______ is responsible for the execution of overall IT program and delegate authority to the CISO for the management of the IAP.
Chief Information Officer (CIO)
The ______ is the focal point for IT management and governance of IT portfolios and is responsible for:
* Ensuring information security management processes are integrated with strategic and operational planning processes.
* Ensuring trained personnel sufficient to assist in complying with the information assurance requirements in related legislation, policies, directives, instructions, standards, and guidelines.
* Coordinating with senior management to report annually to the head of the federal agency on the overall effectiveness of IAP, including progress of remedial actions.
Chief Information Officer (CIO)
The ______ carries out the CIO’s security and privacy responsibilities under FISMA and is responsible for managing the IAP.
Chief Information Security Officer (CISO)
The _______ must:
(i) possess professional qualifications, including training and experience, required to administer the IAP functions;
(ii) maintain information assurance duties as a primary responsibility; and
(iii) head an office with the mission and resources to assist the organization in achieving more secure information and information systems in accordance with FISMA (Federal Information Security Management Act) and Privacy Act requirements.
CISO
The ______ is responsible for:
- Developing an organization-wide IAP that provides adequate security for all information and information systems.
- Centralized reporting of information security-related activities.
- Developing and maintaining information security and privacy policies.
- Defining specific security requirements, tools, templates, and checklists to support the IAP.
- Ensuring that personnel with significant system security responsibilities are adequately trained.
CISO
The ______ is responsible for:
- Assisting senior management concerning their security responsibilities.
- Ensuring the implementation of information privacy and security protections as required by the Privacy Act, FISMA, and memoranda.
- Monitoring security incidents and providing assistance when required.
- Managing the Office of Information and Technology (OIT) audits and program reviews and supporting Office of the Inspector General (OIG) investigations.
- Reporting to the CIO and other senior management on the effectiveness of IAP and developing and submitting the annual FISMA report.
CISO
The _______ is appointed by the CEO and is granted the authority to formally assume responsibility for operating an information system at an acceptable level of risk.
Authorizing Official (AO)
The _____ has budgetary oversight for an information system and is responsible for the mission/business operations supported by the system. They approve systems security plans (SSPs), memorandums of agreement or understanding (MOA/MOU), and plans of action and milestones (POA&Ms).
Authorizing Official (AO)
True or False:
AOs can deny authorization to operate an information system or if the system is operational, halt operations, if unacceptable risks exist. It is possible that a particular information system may involve multiple AOs. If so, agreements are established among the AOs and documented in the SSP.
True
The ______ is responsible for:
* Ensuring the security posture of the Agency’s information systems is maintained.
* Reviewing security status reports and security documents and determining if the risk to the Agency of operating the system remains acceptable.
* Reauthorizing information systems when required.
* Assisting in response to security incidents and privacy breaches.
* Appointing, when required, a designated representative to coordinate and carry out system security responsibilities
AO
The _______ is appointed by the CEO and serves as the focal point for the information system and is the central point of contact during the security authorization process.
Information System Owner (ISO)
The ______ is responsible for:
* Coordinating data protection requirements with Information Owners (IOs) that have information stored and processed in the system.
* Deciding, in coordination with the IO and Information System Security Officer
(ISSO), who has access to the system. Determining access privileges and rights to the system.
* Ensuring that system users and support personnel receive the required security training
(e.g., instruction in the Rules of Behavior).
* Ensuring that the system is compliant with the required security controls.
Information System Owner (ISO)
The ______ is responsible for:
* Appointing an ISSO for the information system to carry out the day-to-day security responsibilities.
* Reviewing system security documents (e.g., SSP, POA&M, etc.).
* Ensuring that system-specific security training is provided to the users and administrators of the systems.
* Ensuring that remediation activities for the system are performed as needed to maintain the authorization status.
* Appointing an Information System Security Manager (ISSM) to coordinate system security task and provide oversight responsibilities to ensure security activities are performed.
ISO
