Authorization Process Flashcards

An Authorizing Official (AO) is reviewing a package for a system whose security assessment found a High-risk weakness that cannot be remediated before the current ATO expires. The mission owner argues the system is critical and cannot go offline. Which action BEST fits the RMF authorization decision options?

Answer: Issue an ATO with conditions (or a time-limited ATO) that states the risk acceptance, required compensating controls, and a defined timeframe for remediation

The AO may issue an authorization to operate with explicit terms and conditions (or a limited duration) when risk is acceptable only with compensating controls and time-bound remediation. A standard ATO ignores the unacceptable residual risk, an IATT is for testing environments only and not for production operations, and an administrative extension without considering the new assessment evidence is not a risk-based decision.

During continuous monitoring, a significant change is proposed: migrating an authorized system's database tier to a different cloud service provider that holds its own FedRAMP-style provisional authorization. What is the MOST appropriate authorization-related step?

Answer: Perform a security impact analysis, reuse the provider's authorization package as evidence where appropriate, assess the customer-responsible controls, and have the AO determine whether reauthorization is required

A significant change triggers a security impact analysis. Inherited controls from a provider's authorization can be leveraged, but customer-responsible and shared controls must still be assessed, and the AO decides whether the change warrants reauthorization. Automatic full inheritance is incorrect, blanket revocation is disproportionate, and after-the-fact notification bypasses required AO involvement.

Under NIST SP 800-37 Rev. 2, which statement about the authorization package and the roles producing its content is MOST accurate?

Answer: The control assessor independently produces the assessment report, while the system owner and common control provider supply the security and privacy plans and the POA&M; the AO decides based on the package

The authorization package typically includes the security and privacy plans, the assessment reports, and the POA&M (plus an executive summary). The assessor produces the assessment reports, the system owner/common control provider prepares plans and POA&M, and the AO makes the decision. The AO should not author the assessment, and the package is more than the SSP and ATO letter.

A system's ATO letter specifies a 'Security-Focused Continuous Monitoring' approach with ongoing authorization. Which condition MOST accurately describes what ongoing authorization requires?

Answer: The organization has fully implemented its continuous monitoring program, the AO receives sufficient near-real-time risk information, and the AO determines on an ongoing basis that risk remains acceptable

Ongoing authorization requires the system to be under an approved continuous monitoring strategy and the AO to have timely risk information to continually determine that risk is acceptable. It is not a license to stop reviewing risk, does not require an annual full reassessment, and is not limited to Low-impact systems.

An organization authorizes a common control provider's enterprise identity management service. A system owner inherits its access control family controls. During the system's authorization review, the AO discovers the common control provider's assessment is 14 months old, and a significant finding was opened since. What is the BEST course of action?

Answer: Consider the provider's current assessment status and the new finding, determine the residual risk impact on the dependent system, and reflect it in the authorization decision and POA&M as needed

Inherited control weaknesses affect all dependent systems. The AO must consider the provider's up-to-date assessment information and open findings, evaluate the residual risk for the dependent system, and document any impact in the decision and POA&M. Assuming validity without checking is unsafe; forcing duplicate reassessment ignores the purpose of common controls; deleting inherited controls misrepresents the control baseline.

An AO is considering the timing of an authorization termination. Which scenario MOST clearly justifies the AO withdrawing (revoking) an existing ATO before its scheduled expiration?

Answer: A newly disclosed critical vulnerability is actively exploited in the system's environment, and the compensating controls and planned remediation can no longer keep the risk within the organization's tolerance

An AO may withdraw or modify an authorization when risk is no longer acceptable, such as when active exploitation of a critical vulnerability exceeds the risk tolerance even with compensating controls. Budget delays on low-risk items, a personnel change, or minor documentation errors do not by themselves make risk unacceptable and are handled through normal management channels.