What is the purpose of a system authorization decision, and which documents support it?

• A. To authorize operation; supported by the SSP, SAR, risk assessment, POA&M, and monitoring plan.
• B. To design system architecture.
• C. To deploy code.
• D. To retire system.

Answer: (A)

The authorization decision answers the question: is it acceptable to allow the system to operate with its current security controls given the assessed risks? In RMF, this is a formal judgment by the authorizing official that the system’s security posture and residual risks are within acceptable levels for the defined environment and mission. The evidence base for that decision comes from the key artifacts that document how controls were implemented, evaluated, and monitored. The System Security Plan describes which controls are in place and how the system is protected; the Security Assessment Report captures the results of testing and evaluation of those controls; the risk assessment analyzes potential threats, vulnerabilities, and impacts; the Plan of Actions and Milestones tracks remediation efforts and status; and the monitoring plan outlines ongoing assessment and continuous monitoring activities. Together, these documents support the decision to authorize operation. Designing architecture, deploying code, or retiring the system are different lifecycle activities and do not constitute the authorization decision.