A DoD component system has finished its Risk Management Framework (RMF) assessment. The Security Control Assessor (SCA) found several residual weaknesses, and these are documented in the Plan of Action and Milestones (POA&M). Under DoDI 8510.01, who has the authority to formally accept the remaining risk and issue an Authorization to Operate (ATO)?

Remaining questions and full explanations are VIP-exclusive.