ISSM must be appointed when there is a contractor-owned classified IS, or a government-owned classified IS at a contractor facility. Which is another duty?

• A. Ensures IS security requirements are met
• B. Conducts market research
• C. Manages payroll
• D. Coordinates travel arrangements

Answer: (A)

Ensuring the information system’s security requirements are met and maintained is the essential duty. When a system is contractor-owned and classified, or government-owned but housed at a contractor facility, the Information System Security Manager (ISSM) is responsible for making sure the security controls defined for that system are properly implemented, kept up to date, and functioning effectively. This includes selecting and applying security controls, performing risk assessments, maintaining the system’s authorization to operate, and overseeing continuous monitoring, incident response, and reporting to the authorizing official. The ISSM acts as the security lead, ensuring compliance with classification handling rules and government policies, and coordinating with system owners and stakeholders to address vulnerabilities or security incidents.

Other tasks like market research, payroll, or travel arrangements fall outside the security management scope for a classified information system and do not directly support maintaining its security posture.