Which of the following professionals plays the role of a monitor and takes part in the organization’s configuration management process?

A.
Senior Agency Information Security Officer

B.
Authorizing Official

C.
Common Control Provider

D.
Chief Information Officer

Explanation:

A Common Control Provider plays the role of a monitor. The responsibilities of a Common Control Provider are as follows.
Develops a continuous monitoring scheme for the assigned common controls. Takes part in the organization’s configuration management process. Establishes a stock of components associated with the common controls. Performs security impact analysis on the changes that affect the common controls. Performs security assessments of the common security controls. Creates and submits security status reports to the defined organizations. Updates critical security documents and provides it to information system owners and other leaders. Performs remediation activities to maintain current authorization status. Answer option D is incorrect. The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise responsible for the information technology and computer systems that support enterprise goals. The CIO plays the role of a leader and reports to the chief executive officer, chief operations officer, or chief financial officer. In military organizations, they report to the commanding officer.
Answer option B is incorrect. An Authorizing Official plays the role of an approver. The responsibilities of an Authorizing Official are as follows.
Ascertains the security posture of the organization’s information system. Reviews security status reports and critical security documents. Determines the requirement of reauthorization and reauthorizes information systems when required. Answer option A is incorrect. A Senior Agency Information Security Officer plays the role of a coordinator. The responsibilities of a Senior Agency Information Security Officer are as follows. Establishes and implements the organization’s continuous monitoring program. Develops organizational guidance and configuration guidance for continuous monitoring of information systems and organization’s information technologies respectively. Consolidates and analyzes Plans of Action and Milestones (POAM) to decide organizational security weakness and inadequacy.
Develops automated tools to support security authorization and continuous monitoring. Provides training on the organization’s continuous monitoring process.
Provides help to information system owners to develop and implement continuous monitoring.
What is configuration management?
Configuration management (CM) is a field of management that focuses on establishing and maintaining consistency of a system’s or product’s performance and its functional and physical attributes with its requirements, design, and operational information throughout its life. For information assurance, CM can be defined as the management of security features and
assurances through control of changes made to hardware, software, firmware, documentation, test, test fixtures, and test documentation throughout the life cycle of an information system. CM for information assurance, sometimes referred to a Secure Configuration Management, relies upon performance, functional, and physical attributes of IT platforms and products and their environments to determine the appropriate security features and assurances that are used to measure a system configuration state. For example, configuration requirements may be different for a network firewall that functions as part of an organization’s Internet boundary versus one that functions as an internal local network firewall.

Reference: FISMA Certification and Accreditation Handbook, Contents. "Understanding the Certification and Accreditation Process"