Trusted Agents must report token security violations to their local ISSO.

• A. True
• B. False
• C. Only with supervisor
• D. Never

Answer: (A)

The main idea is that trusted agents must escalate security incidents to the appropriate security authority. In this context, that means reporting token security violations directly to the local Information System Security Officer (ISSO). Bringing incidents to the ISSO ensures they’re classified, documented, and routed through the proper incident response processes, so the organization can respond quickly, preserve evidence, and implement remediation. The ISSO is the designated point of contact responsible for overseeing token and information security within the local environment, coordinating with other teams as needed. Waiting for a supervisor or withholding the report entirely would delay response and undermine the formal security workflow, so reporting to the ISSO is the correct and expected channel.