Which outcome states that the authorization decision for the system or the common controls is approved or denied?

• A. The authorization for the system or the common controls is approved or denied.
• B. Risk responses are provided.
• C. Authorization decisions are reported to organizational officials.
• D. Ongoing assessments are conducted.

Answer: (A)

In RMF, the key output of the authorization step is the formal decision about whether the system (or its common controls) can operate. The outcome states explicitly that the authorization for the system or the common controls is approved or denied. When approved, an Authorization to Operate (ATO) is granted, indicating the risk is acceptable for operation. When denied, the system cannot operate until deficiencies are addressed and a new authorization decision is made. The other activities—documenting risk responses, reporting the decision to organizational officials, and continuing assessments—support the process but do not themselves state the approval or denial.