Which task involves making the Authorization Decision?

• A. Risk Analysis and Determination
• B. Authorization Decision
• C. Authorization Reporting
• D. Risk Response

Answer: (B)

The task being tested is the formal go/no-go for operation. After reviews of risk, controls, and assessment results, an Authorizing Official evaluates whether the remaining residual risk is acceptable and whether the system can operate within the organization’s risk tolerance. That official decision is the Authorization to Operate (ATO) or its denial. This is the moment that officially authorizes or refuses operation based on the complete security picture and risk acceptance.

Other activities described are part of the surrounding process but not the decision itself: risk analysis and determination focuses on identifying and evaluating risk profiles earlier in the process; authorization reporting documents the outcome of the decision rather than making it; risk response involves planning and implementing actions to reduce risk rather than granting operation.