In the C&A process, to whom do you report?

• A. The ISSO
• B. The CIO
• C. The C&A Manager
• D. The Program Manager

Answer: (A)

In this process, the Information System Security Officer (ISSO) is the main security authority and the primary point of contact for all security-related activities. The team working on certification and accreditation coordinates with the ISSO to gather and validate evidence, ensure controls are properly implemented, and maintain the Security Plan and related artifacts. The ISSO then uses that information to brief and work with the Authorizing Official to obtain the final authorization to operate. The other roles have important duties—coordinating the process, governing IT strategy, or managing the program—but the day-to-day security reporting and alignment with security requirements sit with the ISSO.