CGRC Practice Question: When classifying an information system under FIPS 199, which stakeholder should typically…
When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?
⚠ Common exam trap
CGRC often tests the confusion between the CISO (who sets policy) and the Information System Owner (who is accountable for the system), so candidates may incorrectly choose the CISO for sign-off.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Information System Owner (ISO).
Under FIPS 199 and the NIST RMF, the Information System Owner (ISO) is the stakeholder responsible for the overall procurement, development, integration, modification, operation, and maintenance of the system, and is therefore the appropriate person to sign off on the final security categorization. The ISO ensures the categorization aligns with the system's mission and data sensitivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Lead System Administrator.
Why it's wrong here
A lead system administrator operates and maintains the system but does not own the information or the mission it supports, so cannot accept the impact rating FIPS 199 requires. Administrators are tempting because they know the technical configuration best, yet categorisation authority belongs to the system owner, who is accountable for the data.
- ✓
The Information System Owner (ISO).
Why this is correct
The Information System Owner holds operational accountability for the system and its security posture, so they formally approve the FIPS 199 categorization. Authorising officials and security officers contribute input, but the ISO signs off on the final impact level.
- ✗
The Chief Information Security Officer (CISO).
Why it's wrong here
The CISO sets security policy and advises on risk, but FIPS 199 categorisation is an authorisation decision resting with the system owner, who is accountable for the information and mission. Involving the CISO is tempting because security oversight feels authoritative, yet sign-off must come from the owner who accepts the resulting impact level.
- ✗
The Third-Party Auditor.
Why it's wrong here
A third-party auditor performs independent assessment of controls; it does not own the system's data or mission, so it cannot accept the impact-level determination that FIPS 199 categorisation represents. Auditors are tempting because they validate security documentation, but authorisation to categorise rests with the system owner, who is accountable for the information.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- An organization is defining the authorization boundary for a system that will use a shared database service managed by a…
- A security architect is defining the authorization boundary for a new cloud-hosted financial system. The system uses a m…
- You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for dem…
- Which NIST publication provides the definitive guidance on FIPS 199 security categorization?
- When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.