Which role is a contractor’s information system processing classified information that provides an authorization decision recommendation to the Authorizing Official?

• A. Information System Security Professional / Security Control Assessor (ISSP/SCA)
• B. Information System Security Manager (ISSM)
• C. Information System Security Officer (ISSO)
• D. Inside Director

Answer: (A)

Authorization decisions come from an independent assessment of the system’s security controls, with a formal recommendation delivered to the Authorizing Official. The person who conducts that assessment for a contractor’s classified system and provides the authorization recommendation is the Security Control Assessor, operating under the Information System Security Professional framework. They validate and test the security controls, compile findings, and present the Security Assessment Report and recommendation to the AO so a final risk-based decision can be made. The Information System Security Manager oversees the overall security program and risk management but does not perform the independent assessment or issue the authorization recommendation. The Information System Security Officer handles daily security operations, and the Inside Director isn’t a recognized role in this process.