Which task outcome yields an authorizing package for submission to the authorizing official?

• A. The information system and environment are monitored in accordance with the continuous monitoring strategy.
• B. A risk determination is rendered.
• C. Risk analyses are performed.
• D. An authorizing package is developed for submission to the authorizing official.

Answer: (D)

In this RMF context, the authorizing package is the formal deliverable prepared to seek approval from the Authorizing Official. The task outcome here is the compilation of all necessary evidence and documentation—security plans, risk assessment results, the risk determination, the plan of actions and milestones, and any ongoing monitoring guidance—into a single package ready for submission. Its purpose is to give the Authorizing Official a complete, evidence-based basis to decide whether to authorize operation.

The other activities are important inputs or subsequent steps but do not themselves produce the submission artifact. Continuous monitoring strategy guides ongoing oversight after authorization; risk analyses and the risk determination are parts of the assessment process that feed into the package.