CISSP-ISSEP: Information Systems Security Engineering Professional

An Authorizing Official is accountable for accepting system risk, so the official must understand the information system’s security posture and review the authorization package, security status reports, and related critical security documentation. The Authorizing Official also makes the final determination on whether reauthorization is needed and issues the reauthorization decision. A continuous monitoring program supplies information for these decisions, but establishing and implementing the organization-wide program is not the Authorizing Official’s responsibility.