The Common Control Provider is the role responsible for the development, implementation, assessment, and ongoing monitoring of common controls that are inherited by multiple information systems, and as part of that responsibility participates as a member of the organization's configuration management process for the controls and systems under its purview. The Chief Information Officer and Senior Agency Information Security Officer hold organization-wide security program responsibilities, and the Authorizing Official grants system authorization, but neither of those roles is defined as directly monitoring and participating in configuration management the way the Common Control Provider is.
Community Discussion