Which role has the authority to accept residual risk in RMF?

• A. The Authorizing Official
• B. System Owner
• C. Privacy Officer
• D. Chief Information Security Officer

Answer: (A)

The key idea is who has the formal authority to accept the remaining risk after security controls are in place. In RMF, once controls are implemented and assessed, some risk will remain—that’s the residual risk. The responsibility to accept that residual risk and authorize the system to operate rests with the Authorizing Official. This official has the formal accountability to determine whether the remaining risk aligns with the organization’s risk tolerance and mission needs, and to sign off on the Authorization to Operate.

The System Owner is in charge of the system’s day-to-day operation and ensuring it remains secure, but the ultimate risk acceptance decision is not theirs. The Privacy Officer focuses on privacy-related aspects and compliance, not the overall risk acceptance for the system. The Chief Information Security Officer oversees the security program overall, but the formal sign-off to authorize operation and accept residual risk is given by the Authorizing Official (or a delegated Senior Authorizing Official within defined bounds).

So, the correct role is the one with the authority to accept residual risk on behalf of the organization, ensuring the risk posture after controls reflects the organization’s tolerance.