What specific security responsibilities does an agency head have?
Specific responsibilities of the agency head, per the Information Security Standard (SEC 501-01) -“Key Information Security Roles and Responsibilities”, are to: • Designate an Information Security Officer (ISO) for the agency, biennially. • Ensure that an agency information security program is maintained, that is sufficient to protect the agency’s IT systems, and that is documented and effectively communicated. • Review and approve the agency’s Business Impact Analyses (BIA), Risk Assessments (RAs), and Continuity of Operations Plan (COOP), to include an IT Disaster Recovery Plan, if applicable. • Review and approve the System Security Plans for all agency IT systems classified as sensitive. • Ensure that an Information Security Audit Program is established. Note: Please see the IT Security Audit Standard (COV ITRM Standard SEC502-00) for the agency heads specifics responsibilities regarding audit program compliance. • Ensure a program of Information Security Program is established. •
