Federal IT Security Professional (FITSP) Operator Practice Test

In RMF, the authorization of an information system relies on three roles working together: the person who has the authority to accept risk and grant authorization to operate (Authorizing Official), the individual or team responsible for owning the system and ensuring its security controls are properly implemented (System Owner), and the independent evaluator who assesses the security controls and provides an assessment to support the authorization decision (Security Assessor). The Authorizing Official makes the final risk-based decision, based on the Security Assessment Report and the System Owner’s accountability for the controls. Other options introduce governance or investment roles (like CIO or CPIC) or omit the essential independent assessment, which is why they don’t fit. The combination of Authorizing Official, Security Assessor, and System Owner is the correct set for RMF authorization.