Who drafts the PIA according to the material?

• A. The certifying agent with the ISSO
• B. The System Owner
• C. The CIO
• D. The Security Analyst

Answer: (A)

PIA stands for Privacy Impact Assessment and is part of the system authorization package. It explains how a system handles personal information and what privacy risks exist, along with the measures to mitigate them. In the certification and accreditation process, the person who leads and drafts the authorization artifacts is the certifying agent. Working with the Information System Security Officer ensures that privacy considerations are woven into the security review and that the PIA reflects both privacy and security controls. The System Owner oversees the system’s operation and requirements, but the formal drafting of the PIA is carried out by the certifying agent in collaboration with the ISSO. The CIO approves the package, and the Security Analyst may contribute but does not own the drafting. So the combination of the certifying agent and the ISSO is responsible for drafting the PIA.