System owner is correct. The System owner is accountable for the overall security of the information system and for scheduling and ensuring periodic evaluations of the system security controls to verify their continued effectiveness.

The System owner has responsibility for the system throughout its lifecycle and must manage risk by arranging assessments, tracking remediation of findings, and retaining evidence that controls remain effective. The System owner coordinates with assessors and informs the Authorizing official of assessment outcomes so that the Authorizing official can make informed risk acceptance decisions.

Security control assessor is responsible for performing the independent technical evaluation of controls and producing assessment results. They are not typically the party accountable for scheduling or ensuring the programmatic follow up and remediation for a specific system.

Authorizing official makes the final risk acceptance decision and authorizes system operation based on assessment evidence. This role relies on reports and evidence but does not usually manage the scheduling and ongoing administration of control evaluations.

Information security officer provides enterprise level policy, guidance, and oversight for the security program. They support and advise system owners and set assessment policy, but they are not directly accountable for arranging and ensuring periodic evaluations for an individual information system.

Full AWS Practitioner Certification Question