Rochelle Morton

Senior Security Control Assessor @Chenega Corporation

Arlington, VA, US

Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability of the information on systems.Ensure security assessments are completed for each IS.Initiate a POA & M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR.Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO.Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization.Serve as a cybersecurity technical advisor to the CISO and AO under their purview.Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies.Determine and document in the SAR a risk level for every noncompliant security control in the system baseline.Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA\'s risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation.Develop a continuous monitoring plan specific to the information system.