Exam CISSP topic 1 question 264 discussion

Implementation=custodian

The question says "technical implementation decisions are done by the head of the IT department" The Head of IT implements decisions. Custodians implement management decisions

8.2.5 Information System Security Officer The ISSO is the agency official assigned responsibility by the SAISO, authorizing official, management official, or information system owner for ensuring that the appropriate operational security posture is maintained for an information system or program. The ISSO has the following responsibilities related to system security plans: • Assisting the SAISO in identifying, implementing, and assessing the common security controls; and • Actively supporting the development and maintenance of the system security plan, to include coordinating system changes with the information system owner and assessing the security impact of those changes. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-100.pdf (pg 79)

I choose A

A. System security officer A custodian holds info, as in custody: "A third-party entity that holds and safeguards a user’s private keys or digital assets on their behalf. Depending on the system, a custodian may act as an exchange and provide additional services, such as staking, lending, account recovery, or security features." https://csrc.nist.gov/glossary/term/custodian#:~:text=Definition(s)%3A,account%20recovery%2C%20or%20security%20features.

Answer is A System Security Officer

Answer A "Individual assigned responsibility by the senior agency information security officer, authorizing official, management official, or information system owner for ensuring that the appropriate operational security posture is maintained for an information system or program" https://csrc.nist.gov/glossary/term/information_system_security_officer

I agree. A. system security officer. systems security officer (SSO) show sources. CNSSI 4009-2015. Definition(s): Individual with assigned responsibility for maintaining the appropriate operational security posture for an information system or program.

I prefer A