ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The Authorizing Official is a senior management role that has the statutory authority to assume responsibility for operating an information system at an acceptable level of risk. After reviewing the Security Assessment Report and other authorization package artifacts, the Authorizing Official issues the formal Authorization to Operate (ATO). The System Owner is responsible for the system throughout its life-cycle but cannot grant authorization. The Information System Security Officer supports security operations and reporting but does not make risk acceptance decisions. The Security Control Assessor conducts the assessment and provides findings but likewise lacks the authority to authorize operation.