- We discussed different roles within the RMF process, which one is responsible for signing off on the Package and determines whether a system receives an ATO or NATO or an IATO?

Authorizing Official

System Owner

ISSO

Chief Information Security Officer

- Why is it important to identify the Office / Organization responsible for resolving the POAM?

It makes an Office accountable for tracking and making sure that a POAM is fixed and completed

It forces an Office/Organization to remediate a POAM within the scheduled completion date

It forces an Office / Organization remediate a POAM in the order of the prioritization fo the POAMs

- The main idea behind continuous monitoring is so that an organization can monitor and continuously assess the security posture of a system in the most cost-effective way possible. True or false