Which outcome indicates that an authorizing package is created for submission to the authorizing official?

• A. The authorization for the system is approved or denied.
• B. An authorizing package is developed for submission to the authorizing official.
• C. Ongoing assessments of control effectiveness are conducted.
• D. Risk determinations are rendered.

Answer: (B)

In RMF practice, the authorizing package is created to present evidence to the Authorizing Official. This package compiles the system description, security controls, assessment results, risk determinations, and the plan for corrective actions, and it is prepared specifically for submission to the AO. When that package is developed and handed to the AO, it signals readiness for the authorization decision. The final decision to approve or deny comes after reviewing the package, so that outcome reflects what happens after submission rather than the act of creating the package itself.