Which outcome states that the authorization for the system or the common controls is approved or denied?

• A. Authorization decisions are reported to officials.
• B. The authorizing package is developed.
• C. The authorization for the system or the common controls is approved or denied.
• D. Ongoing assessments are conducted.

Answer: (C)

In this area, the key outcome is the formal authorization decision made by the authorizing official. After the security controls are assessed and the risk analysis is complete, the official evaluates whether the system (or its common controls) can operate within the organization's risk tolerance. The result is a clear decision to authorize or not authorize operation. When the risk is acceptable, an Authority to Operate (ATO) is granted (often with conditions or a POA&M). If the risk is not acceptable, authorization is denied or postponed until remediation is completed.

This is the best choice because it states the exact outcome of the authorization step—the system’s approval to operate or denial—rather than describing the development of the package or ongoing monitoring, which are separate parts of the process.