Security and Privacy Governance, Risk Management, and Compliance Program
The first domain tests whether you understand why an authorization decision exists at all: the laws, policies, and organizational machinery that force a system to be categorized, documented, assessed, and formally accepted. Expect questions on statutory roles, the three-tiered risk model, and who may accept which kind of risk.
The legal and policy stack
FISMA (44 U.S.C. §3551–3558) requires each federal agency to run an agency-wide information security program and assigns duties: the agency head is accountable, the CIO implements and reports, the CISO monitors and advises, and the Authorizing Official (AO) accepts risk. OMB Circular A-130 sets government-wide policy and points agencies to NIST standards. NIST SP 800-39 describes risk management at three tiers - organization, mission/business process, and information system - while NIST SP 800-37 Rev. 2 supplies the seven-step RMF: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.
Roles you must not confuse
- AO: senior official with authority to accept risk for the organization; issues the authorization decision.
- System owner: accountable for operation, maintenance, and SSP accuracy.
- ISSO: day-to-day security operations and documentation.
- SCA: independent assessor who evaluates controls and reports; never authorizes.
- CISO and privacy officer: oversight, policy, and privacy input - not risk acceptance.
Risk response options are accept, avoid, mitigate, and transfer/share. Privacy obligations flow from the Privacy Act of 1974, the E-Government Act §208 (PIA requirement), and OMB guidance on SORNs.
Worked example
A system owner adds a cloud interconnection after authorization and asks the ISSO to "sign off." The ISSO cannot. A new interconnection and external service change the risk posture, so the change re-enters the Prepare step and requires a significant-change determination. If judged significant, the AO - not the system owner - decides whether operation continues and whether new controls, such as an interconnection security agreement, must be in place before risk is re-accepted.
Traps that cost marks
- Treating the SCA as the approving official.
- Assuming "accept" is the only risk response.
- Forgetting the AO must be senior enough to commit resources.
- Confusing the CISO's advisory role with authorization authority.