Authorization Process Flashcards

A system owner's ATO for a moderate-impact system expires in 60 days. The organization has implemented a fully functional ongoing authorization program with automated continuous monitoring that meets the AO's defined risk tolerance. Which statement BEST describes the correct application of the RMF in this situation?

Answer: The system may transition to ongoing authorization if the AO explicitly determines that risk remains acceptable based on continuous monitoring, and the authorization then has no fixed termination date

Under NIST SP 800-37 Rev. 2, once the AO has authorized the system and the organization has an approved continuous monitoring program with ongoing assessment, the AO may adopt ongoing authorization. This requires an explicit AO decision that the risk remains acceptable, and the authorization is then time-unbounded as long as the AO continues to receive current risk information. It is not automatic, and fixed three-year terms are not mandatory.

During the Authorize step, an AO reviews the authorization package and finds that a high-impact finding cannot be remediated for 9 months, but the mission requires the system to operate now. The AO wants to permit operation while keeping the decision defensible. Which action is MOST appropriate?

Answer: Issue an ATO with explicit terms and conditions, including compensating controls, restrictions, and POA&M milestones tied to the risk response, documenting the risk acceptance rationale

RMF permits the AO to authorize operation with conditions where mission need justifies the residual risk. The authorization decision document should state terms and conditions, any restrictions, and the rationale for risk acceptance, supported by the POA&M. An unconditioned ATO is poorly defensible, a denial is not required, and risk acceptance authority cannot be delegated down to the ISSO.

Which of the following BEST distinguishes a Common Control Provider's authorization responsibilities from those of a system owner inheriting those controls?

Answer: The common control provider's assessment and authorization of the common controls must be available to the inheriting system's AO, who relies on that information in making a system-level risk decision, while the AO retains responsibility for the system's overall risk acceptance

Common control providers develop, implement, assess, and monitor common controls and make authorization information available to inheriting system owners. The inheriting system's AO relies on that evidence but still accepts risk for their own system. Inherited controls are referenced in the package, not excluded, and the provider's AO does not accept risk for downstream systems.

An AO signs an ATO on March 1. On May 15, a significant change is made to the system's cryptographic module, altering how data at rest is protected. What is the MOST appropriate response under the RMF?

Answer: Perform a security impact analysis, and if the change affects the risk posture materially, reassess the affected controls and update the authorization package so the AO can determine whether the authorization decision remains valid

Significant changes require a security impact analysis during the Monitor step. If risk is materially affected, affected controls are reassessed and the package updated, giving the AO current information to decide whether the existing authorization remains acceptable. Full restarts are not generally required, and delayed notification is inadequate for a significant change.

A system is categorized as moderate, but it processes data that, when aggregated with an adjacent system's data, produces a high-impact aggregate. Which authorization consideration is MOST relevant?

Answer: The AO should evaluate whether the system's categorization and authorization decision should account for aggregation effects, since impact may exceed the individual system's baseline

Categorization under FIPS 199 and SP 800-60 requires consideration of aggregation, where combined information types or connected systems may raise the impact level. The authorizing official should confirm the categorization reflects such effects, and the authorization decision should address the resulting risk. Ignoring aggregation or limiting it to only one AO leaves risk unaddressed.

When two AOs from different organizations share responsibility for a single interconnected system, which RMF approach is MOST appropriate to authorize it?

Answer: A joint authorization in which the AOs collaborate, share the authorization package and responsibilities, and issue a single or coordinated authorization decision

NIST SP 800-37 describes joint authorization where multiple AOs from different organizations collaborate and share responsibility for a system, typically with a lead AO coordinating. This differs from leveraged authorization, in which one organization relies on another's existing authorization. Independent uncoordinated decisions or unilateral takeover by one CISO do not reflect the guidance.