Authorization Decision After a Critical Vulnerability and Unapproved Cloud Replication
A system has an ATO expiring in 30 days. The monthly ConMon scan finds a CVSS 9.8 remote-code-execution vulnerability in an internet-facing component; the vendor patch is 21 days away. The CSP has added a new region, and the agency enabled replication for disaster recovery without notifying the AO; backups now reside in a country not approved for law enforcement data. The system already carries High residual risk with four open POA&Ms, including an overdue MFA fix. The mission owner requests a 90-day extension of the ATO and says the new region is just a backup. The AO must decide.
1. What authorization decision options does the AO have, and which is most defensible? Include conditions.
Read the worked answer
The AO's options include ATO, ATO with conditions, interim authorization to test (IATT), and denial of authorization to operate (DATO). IATT is for limited testing, not for extending production authorization, so it is not the right vehicle here.
The most defensible starting point is to deny the 90-day extension as requested until the data-residency issue is contained and the vulnerability is mitigated. A conditional ATO is possible only if the AO can bound the risk. Conditions should include:
- Immediately disable the new region and stop replication; repatriate or securely delete data from the unapproved country, with legal and privacy review.
- Patch the CVSS 9.8 vulnerability within 21 days or apply verified compensating controls such as WAF rules, network segmentation, and enhanced monitoring.
- Address the overdue MFA POA&M or provide a dated corrective action plan.
- Require daily vulnerability and access reporting until the critical items close.
- Update the SSP, SAR, and POA&M, and verify remediation independently.
If those conditions cannot be met, DATO is appropriate. The mission owner cannot self-authorize or treat a backup region as automatically out of scope.
2. Is enabling the new cloud region a significant change? What process applies?
Read the worked answer
Yes, this is likely a significant change. It changes the system's architecture, data location, disaster recovery posture, and possibly its legal and regulatory exposure. Data now resides in a country not approved for law enforcement data, which is not a routine backup detail.
Under the RMF, a significant change requires a significant change assessment and AO notification before continued operation. The agency should:
- Stop replication to the new region and assess what data was transferred.
- Update the authorization boundary and data-flow documentation.
- Reassess affected controls, especially SC-7, SC-8, CP-6, CP-7, AC-4, and any data-residency or privacy controls.
- Update the SSP, SAR, and POA&M, and obtain AO approval or reauthorization.
Even if the agency concludes the change is not significant, it still requires configuration and change management, risk assessment, and ConMon reporting. The AO, not the mission owner, decides whether the change is significant enough to affect authorization.
3. What should the ConMon report and POA&M show, and how does ongoing authorization work here?
Read the worked answer
The ConMon report should show the critical vulnerability, its exploitability, affected component, compensating controls, patch date, and current risk. It should also show the new region and data-residency issue as a separate high-risk item, including when replication began, what data moved, and containment status.
The POA&M should have entries for:
- The CVSS 9.8 vulnerability with a 21-day milestone and verification method.
- Removal of the unapproved region and data repatriation or deletion.
- The overdue MFA fix with a realistic date and owner.
- Any revised authorization conditions and the evidence required to close them.
Ongoing authorization depends on the AO receiving timely, accurate ConMon data. If the risk exceeds the AO's tolerance, the AO can modify conditions, restrict operation, or revoke the ATO. The mission owner's request for a 90-day extension does not pause ConMon obligations. The AO should also consider whether the data transfer triggers incident reporting, privacy, or legal notification requirements.