Which outcome describes the formal review and approval by the authorizing official?

• A. The authorizing official approves the system security plan, but not the privacy plan.
• B. The security and privacy plans reflecting the selection of controls necessary to protect the system and environment of operation commensurate with risk are reviewed and approved by the authorizing official.
• C. Plans are approved by the project sponsor.
• D. Approval is optional.

Answer: (B)

In the RMF process, the formal authorization decision rests with the Authorizing Official, who reviews the final package and approves it. The crucial element is that the security and privacy plans, showing the chosen controls needed to protect the system and its operating environment in line with the assessed risk, are reviewed and approved by the Authorizing Official. This approval demonstrates that residual risk is acceptable and grants authorization to operate. It’s not just the security plan alone, not something the project sponsor decides, and approval isn’t optional.