Authorization Process Flashcards

An Authorizing Official (AO) formally delegates authorization duties to an Authorizing Official Designated Representative (AODR) during an extended deployment. The AODR has reviewed the full authorization package, coordinated with the risk executive (function), and prepared a recommendation. According to NIST SP 800-37 Rev. 2, which action is the AODR still NOT permitted to take?

Answer: Make the final authorization decision, accept the residual risk, and sign the authorization decision document

NIST SP 800-37 Rev. 2 lets the AO delegate almost every authorization task to an AODR, including approving plans, coordinating activities, and monitoring the POA&M. The authorization decision itself cannot be delegated: accepting risk to organizational operations, assets, individuals, other organizations, and the Nation, and signing the decision document, stay with the AO. Formal accountability for the risk stays with the AO, so the decision does too.

A federal agency wants to use a cloud service that already holds a provisional authorization. The agency's AO reviews the provider's existing authorization package, decides to rely on its assessment evidence instead of reassessing, and formally accepts the risk of the agency using the service. No new security assessment is performed. Which authorization decision type BEST describes what the agency AO issued?

Answer: Authorization to use (ATU)

NIST SP 800-37 Rev. 2 defines an authorization to use (ATU) for cases where an organization relies on another organization's authorization package for a system or service it consumes. The consuming AO reviews the existing evidence and accepts the risk of using the system, typically without reassessing it. Under a joint authorization, multiple AOs share responsibility for a single decision. A type authorization covers identical systems deployed at multiple sites. A common control authorization applies to inheritable controls, not to a consumed external service.

An organization wants to move a system from periodic three-year reauthorizations to ongoing authorization. The CISO proposes several changes. Which one is a TRUE prerequisite for ongoing authorization under NIST guidance?

Answer: The system must have received an initial authorization based on a complete, zero-base review, and an ISCM program must produce security and privacy information often enough to support near-real-time risk decisions

Ongoing authorization depends on two things. First, the system must have an initial authorization based on a complete, zero-base review of its controls. Second, the organization must have a robust information security continuous monitoring (ISCM) program that gives the AO current information. Once these are in place, the AO makes time-driven and event-driven risk decisions instead of relying on a fixed termination date. A shorter termination date keeps the periodic model. Closing all POA&M items is not required. The AO keeps responsibility; the risk executive (function) provides input but does not make the decision.

A common control provider submits a package for enterprise boundary protection controls that 40 systems inherit. The AO responsible for those common controls issues a denial of common control authorization. What is the MOST significant consequence for the systems that inherit those controls?

Answer: The controls are not authorized for inheritance, so each inheriting system's AO must reassess the risk to their system and may require compensating or system-specific controls

A denial of common control authorization means the controls are not approved for inheritance. The inheriting systems' authorizations are not automatically revoked. Their AOs can no longer assume that the risk from those inherited controls has been accepted, so each must reassess the risk to their own system. That reassessment may lead to system-specific or compensating controls, POA&M updates, or a change to the system's authorization. A POA&M entry does not override a denial.

Two agencies co-fund and co-operate a shared case-management system. Each agency's AO has a stake in the system and wants a say in risk acceptance. The agencies need a single authorization decision with shared responsibility. Which approach meets this requirement, and what must the AOs do?

Answer: Joint authorization, where the AOs plan the authorization together, agree on its terms and conditions, and share responsibility and accountability for the decision

A joint authorization is used when multiple AOs, from the same organization or from different organizations, have a shared interest in one system. The AOs plan the authorization together, agree on its terms and conditions, and share responsibility and accountability for the risk. With a leveraged authorization, one AO authorizes and another reuses the package, so responsibility is not shared in a single decision. Type authorization covers identical deployed instances. Facility authorization covers the environment in which systems operate.

A type authorization covers an identical sensor-management system that will be installed at 25 field sites. A site security officer says that because the system already holds a type authorization, the site has no further authorization-related work to do. Why is this INCORRECT?

Answer: A type authorization covers the system's common, identical controls, but each site must still provide and verify the site-specific (environmental and operational) controls the deployed system depends on

A type authorization is a single authorization for one system or set of systems deployed identically at multiple locations. It covers the controls that are the same across every deployment. Controls that depend on the operating environment, such as physical protection, power, and local personnel and operational procedures, still have to be provided by each receiving site and verified there, often through a facility authorization or the site's own processes. Each site does not need a full independent reassessment. A type authorization is not an interim approval, and responsibility does not pass to a facility manager.