CGRC Authorization Process 2

Question 1

Which document formally grants a system the authority to operate and is signed by a senior official?

Accepted Answer

Authorization to Operate (ATO)

Answer

An Authorization to Operate (ATO) is the formal decision document signed by an Authorizing Official granting a system permission to operate.

Question 2

What role is ultimately accountable for accepting residual risk and issuing an authorization decision under NIST RMF?

Accepted Answer

Authorizing Official (AO)

Answer

The Authorizing Official (AO) is the senior executive who accepts residual risk and signs the authorization decision.

Question 3

A system is granted permission to operate for 90 days while remediation of high-risk findings is completed. This is best described as:

Accepted Answer

Interim Authorization to Operate (IATO)

Answer

An Interim Authorization to Operate (IATO) allows temporary operation while significant security issues are being remediated.

Question 4

Which of the following is NOT typically included in an authorization package submitted to the Authorizing Official?

Accepted Answer

Vendor contract for hardware procurement

Answer

Authorization packages consist of the SSP, SAR, and POA&M; vendor procurement contracts are not part of the authorization package.

Question 5

Under NIST SP 800-37, what triggers the need to re-authorize a system before its ATO expiration date?

Accepted Answer

Significant change that affects the security posture

Answer

Significant changes that impact a system's security posture require re-authorization even before the current ATO expires.

CGRC - Certified Governance Risk and Compliance Practice Test