Who performs classified Information System assessments?

• A. Facility Security Officer (FSO)
• B. Information System Security Manager (ISSM)
• C. Program Manager
• D. Defense Counterintelligence and Security Agency (DCSA)

Answer: (A)

The on-site Facility Security Officer is responsible for the facility’s security program, including ensuring classified information systems are properly reviewed. The FSO coordinates and often conducts the classified Information System assessments to verify that access controls, procedures, physical protection, and incident response practices meet requirements and that any findings are tracked and remediated. The Information System Security Manager handles the technical security of the information system but work under the facility’s security leadership to implement controls, not as the primary on-site assessor. The Defense Counterintelligence and Security Agency provides external oversight and audits, not day-to-day assessments performed at the facility, and the Program Manager focuses on mission execution rather than security assessments. So the Facility Security Officer is the best fit to perform these assessments.