thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

RMF Authorize Step

RMF step in which a senior official decides whether the residual risk of operating a system is acceptable.

Definition

The authorization package (SSP, SAR, POA&M, and executive summary) is submitted to the authorizing official, who determines risk and issues an authorization decision: authorize to operate, or deny authorization. The AO's decision is a risk acceptance on behalf of the organization.

Example

The AO grants a three-year ATO with conditions that two high findings be closed in 90 days.

Exam tip

Only the AO can accept the risk; the ISSO or assessor cannot.

Related terms