In RMF, what does risk acceptance entail in relation to an ATO?

• A. Risk acceptance means all risk is rejected before authorization.
• B. Risk acceptance occurs when residual risk is zero.
• C. The AO documents risk acceptance in a separate waiver.
• D. The AO may accept residual risk within tolerance as part of the authorization decision.

Answer: (D)

In RMF, risk acceptance is the formal decision by the Authorizing Official to operate with the residual risk that remains after safeguards are applied, as long as that risk is within the organization’s established risk tolerance. After controls are implemented and the security posture is assessed, some level of risk will persist. If that residual risk fits what the organization is willing to accept, the AO includes this acceptance in the authorization decision, allowing an ATO to be granted. This acknowledges that zero risk is rarely achievable and that the mission can proceed when the remaining risk is deemed acceptable and is subject to ongoing monitoring. While a separate waiver can exist in some cases, the standard mechanism is to document risk acceptance as part of the authorization decision.