Who conducts security reviews to ensure a program is in compliance with the NISPOM?

• A. Cognizant Security Office (CSO)
• B. Contracting Officer (CO)
• C. Information System Security Manager (ISSM)
• D. Facility Security Officer (FSO)

Answer: (A)

Security oversight for NISPOM compliance is performed by the Cognizant Security Office, which conducts formal security reviews, inspections, and assessments of a contractor’s program to verify it meets NISPOM requirements. This office is responsible for checking safeguarding measures, incident reporting, and overall program adequacy, and it can authorize or require corrective actions.

The Contracting Officer handles procurement and contract terms but does not perform the security program review. The Information System Security Manager focuses on implementing and maintaining the organization’s information security controls day to day. The Facility Security Officer runs on-site, facility-level security tasks like personnel clearance processing and physical access, but external compliance reviews are the CSO’s responsibility.