Which role is responsible for establishing, documenting, maintaining, and monitoring IS security programs and procedures?

• A. ISSM
• B. DSS
• C. IFSO
• D. FSO

Answer: (A)

The Information System Security Manager is responsible for establishing, documenting, maintaining, and monitoring the IS security program and its procedures. The ISSM holds the overall accountability for the security posture of the information system, shaping the security strategy, and ensuring that policies, plans, and controls are created and kept up to date. They oversee continuous monitoring, risk management processes, and the authorization-to-operate activities, coordinating with system owners, the security officer who handles day-to-day implementation, and other stakeholders. This makes the ISSM the best fit for setting up the program, keeping it current, and ensuring it is effectively monitored.

Facility Security Officer focuses on physical security and facility-related matters, while the Information Security Officer roles and the DSS designation are more about specific duties or agencies rather than owning the entire security program. The ISSO, although essential for implementing and enforcing security controls on a system, operates under the ISSM and does not typically own the overall IS security program.