System Compliance
System compliance is where the authorization decision is made and defended. The exam expects you to assemble the authorization package, reason about residual risk, and choose the right decision type.
The authorization package
NIST SP 800-37 Rev. 2 packages the SSP, the SAR, and the POA&M, plus the AO's determination and decision document. The AO reads them together: the SSP says what is claimed, the SAR says what was found, the POA&M says what remains open and when it will close. Residual risk is what remains after POA&M commitments are taken into account.
Decision types
- Authorization to operate (ATO): risk is acceptable and the system may operate.
- ATO with conditions: operation is permitted only if specified POA&M actions are completed by agreed dates; conditions must be verifiable.
- Interim authorization to operate (IATO): limited, time-boxed operation while high-risk findings are remediated; common in provider contexts such as FedRAMP.
- Denial of authorization to operate: risk exceeds what the AO will accept.
An AO may leverage another AO's package through reciprocity but still owns the decision for their system. Decisions carry a defined term and are revisited when a significant change occurs.
Worked example
A SAR shows two high findings: an unpatched internet-facing server and missing multifactor authentication for privileged accounts, on a system supporting a payment function. The AO does not issue an ATO. Because the patch takes three days and MFA thirty, the AO issues a 30-day IATO with weekly status reporting, conditions requiring the patch immediately and MFA within thirty days, and POA&M milestones with named owners. Denial is reserved for cases where no acceptable interim risk exists.
Traps that cost marks
- Writing conditions that cannot be verified, such as "improve security culture."
- Confusing the AO's risk acceptance with the SCA's findings.
- Assuming reciprocity is automatic.
- Issuing an ATO with high findings open and no POA&M commitment.