Authorization of Information Systems
The decision to operate
The authorization decision is the AO's formal acceptance of residual risk based on the assessment evidence, the system security plan, and the plan of action and milestones. Candidates should understand that authorization is a risk decision, not a technical verdict, and that it can be granted, granted with conditions, or denied. Authorization has a defined period and scope, and it can be revoked if risk changes materially.
Supporting artifacts
Know the package: the system security plan, the security assessment report, and the plan of action and milestones documenting unresolved weaknesses. The AO weighs mission need against risk and may accept certain weaknesses with compensating controls. Continuous monitoring commitments are often conditions of authorization.
Traps to watch
Questions often suggest the assessor or system owner authorizes the system; only the AO does. Another trap is treating authorization as permanent. A third is assuming a plan of action and milestones blocks authorization; it documents accepted risk and remediation timelines. Watch also for confusion between authorization and accreditation terminology across frameworks.
Rule of thumb
The AO decides, the evidence informs, and conditions bind. Worked example: an assessor reports a moderate finding in contingency planning. The AO grants authorization with a condition that the plan be tested within 90 days, and the plan of action and milestones tracks the remediation. If the condition is missed, the AO may revisit the decision.