Which of the following roles are filled by contractor employees?

• A. Insider Threat Program Senior Official (ITPSO)
• B. Facility Security Officer (FSO)
• C. Information System Security Manager (ISSM)
• D. All of the above

Answer: (D)

These roles are about security governance and day-to-day risk management, not about who must hold the position. The Facility Security Officer is the point person for protecting classified information at the site, managing the facility clearance, and coordinating with government security contacts; a qualified contractor can perform this function under the contract with proper oversight. The Information System Security Manager oversees the security of the information systems, implementing the risk management framework and ensuring compliance with security requirements; contractors with the right RMF expertise commonly fill this role. The Insider Threat Program Senior Official leads the insider threat program, coordinating training, reporting, and mitigation activities; this position can be held by a contractor who has the necessary authority and access. Because each role can be effectively staffed by trained contractor personnel, all of these roles can be filled by contractor employees.