Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Appendix D. > 2.4 ISCM ROLES AND RESPONSIBILITIES

2.4 ISCM ROLES AND RESPONSIBILITIES

This section describes the roles and responsibilities of key participants involved in an
organization's ISCM program. Widely varying missions and organizational structures may lead to
differences in naming conventions for ISCM-related roles and how specific responsibilities are
allocated among organizational personnel (e.g., multiple individuals filling a single role or one
22 See NIST SP 800-53A, as amended, for information on assessment objects.
individual filling multiple roles). Roles and responsibilities commonly associated with ISCM
include:
Head of Agency. The agency head is likely to participate in the organization's ISCM program
within the context of the risk executive (function).
Risk Executive (Function). The risk executive (function) oversees the organization's ISCM
strategy and program. The risk executive (function) reviews status reports from the ISCM process
as input to information security risk posture and risk tolerance decisions and provides input to
mission/business process and information systems tier entities on ISCM strategy and
requirements; promotes collaboration and cooperation among organizational entities; facilitates
sharing of security-related information; provides an organization-wide forum to consider all
sources of risk; and ensures that risk information is considered for continuous monitoring
decisions.
Chief Information Officer (CIO). The CIO leads the organization's ISCM program. The CIO
ensures that an effective ISCM program is established and implemented for the organization by
establishing expectations and requirements for the organization's ISCM program; working
closely with authorizing officials to provide funding, personnel, and other resources to support
ISCM; and maintaining high-level communications and working group relationships among
organizational entities.
Senior Information Security Officer (SISO). The SISO establishes, implements, and maintains
the organization's ISCM program; develops organizational program guidance (i.e.,
policies/procedures) for continuous monitoring of the security program and information systems;
develops configuration management guidance for the organization; consolidates and analyzes
POA&Ms to determine organizational security weaknesses and deficiencies; acquires or develops
and maintains automated tools to support ISCM and ongoing authorizations; provides training on
the organization's ISCM program and process; and provides support to information
owners/information system owners and common control providers on how to implement ISCM
for their information systems.
Authorizing Official (AO). The AO assumes responsibility for ensuring the organization's ISCM
program is applied with respect to a given information system. The AO ensures the security
posture of the information system is maintained, reviews security status reports and critical
security documents and determines if the risk to the organization from operation of the
information system remains acceptable. The AO also determines whether significant information
system changes require reauthorization actions and reauthorizes the information system when
required.
Information System Owner (ISO)/Information Owner/Steward. The ISO establishes processes
and procedures in support of system-level implementation of the organization's ISCM program.
This includes developing and documenting an ISCM strategy for the information system;
participating in the organization's configuration management process; establishing and
maintaining an inventory of components associated with the information system; conducting
security impact analyses on changes to the information system; conducting, or ensuring conduct
of, assessment of security controls according to the ISCM strategy; preparing and submitting
security status reports in accordance with organizational policy and procedures; conducting
remediation activities as necessary to maintain system authorization; revising the system-level
security control monitoring process as required; reviewing ISCM reports from common control
providers to verify that the common controls continue to provide adequate protection for the
information system; and updating critical security documents based on the results of ISCM.