Risk Acceptance When the Owner and the AO Disagree
A system has completed assessment with two High-risk findings: an unpatched remote-code-execution vulnerability in an internet-facing component, and a lack of multi-factor authentication for administrative access. The system owner argues both are acceptable because the component is behind a web application firewall and administrators are 'trusted, long-tenured staff.' Remediation for the first is estimated at three weeks; MFA at six weeks. The system owner wants immediate authorization because a program deadline depends on the system going live. The authorizing official is under pressure from program leadership to approve. The security team notes that the WAF has a known bypass for the specific vulnerability class and that two administrators separated from the agency last year without their credentials being revoked promptly.
1. How should the authorizing official reason about the system owner's risk acceptance arguments, and what decision options are available?
Read the worked answer
The authorizing official must treat the owner's arguments as risk assertions to be tested, not conclusions to adopt. The WAF argument is undermined by the security team's report of a known bypass for this vulnerability class - a compensating control that does not cover the specific threat provides little risk reduction. The 'trusted, long-tenured staff' argument is undermined by the fact that two administrators separated without prompt credential revocation; that is direct evidence the trust assumption has already failed once. Trustworthiness of people is not a substitute for MFA, which protects against credential compromise regardless of intent.
The AO's options include: (1) deny authorization until both findings are remediated; (2) grant a time-limited authorization to operate with conditions, requiring remediation within defined milestones (three weeks for the patch, six weeks for MFA) and interim compensating measures; (3) grant an interim authorization with a plan of action and milestones and explicit risk acceptance; or (4) require a denial with appeal path if risk is unacceptable. The program deadline is a mission consideration the AO may weigh, but it cannot override the AO's independent risk judgement. The AO should document the decision and its rationale, including why the owner's compensating-control claims were insufficient.
2. If the AO grants a conditional authorization, what conditions and monitoring should be attached, and how should the AO handle pressure from program leadership?
Read the worked answer
Conditions should be specific, measurable, and time-bound. For the vulnerability: patch within three weeks, with a documented interim mitigation (virtual patching at the WAF, restricting the component's exposure, or heightened monitoring) and weekly status reporting. For MFA: deploy within six weeks, with an interim requirement to verify and revoke all administrative credentials immediately, inventory all administrative accounts, and require out-of-band confirmation for administrative actions until MFA is live. The AO should also require confirmation that the two separated administrators' credentials are revoked now, since that is an immediate exposure independent of the findings.
Monitoring should include a remediation tracker reviewed at defined intervals, automatic escalation if milestones slip, and a defined trigger for re-review - for example, any missed milestone or discovery of exploitation attempts. The conditional authorization should state the consequences of non-compliance, including suspension.
On program-leadership pressure: the AO's authority is independent by design, and the decision must rest on risk to the agency and the public, not schedule. The AO should communicate the decision and rationale in writing to leadership, explain the conditions and timeline, and make clear that a conditional authorization is itself a path to meeting the deadline responsibly. Caving to pressure and issuing an unconditional authorization would transfer unmitigated High risk to the agency without a documented decision - precisely what the authorization function exists to prevent.