Authorization of Information Systems
The authorization decision
Authorization is the AO's formal decision to accept residual risk and permit system operation. The AO reviews the authorization package: the SSP, SAR, POA&M, and continuous monitoring strategy. The AO considers mission need, risk tolerance, and the organization's risk management strategy. The result may be an authorization to operate (ATO), a denial of authorization to operate (DATO), or an interim authorization to test (IATT). An IATT is temporary and limited in scope. Authorization is not a claim of zero risk; it is an accountable risk acceptance.
Roles and boundaries
The system owner operates the system and prepares the package; the SCA assesses and reports; the AO decides. The AO's accountability cannot be delegated away, although staff support the decision. The authorization boundary defines what is covered, including interconnected systems and common controls. Terms and conditions may require remediation within specified timeframes.
Traps
Candidates often confuse the AO with the system owner or SCA. The SCA recommends; the AO authorizes. Certification is an older term-do not treat it as identical to authorization. An ATO is not permanent and must be revisited after significant change or when monitoring shows unacceptable risk. A DATO is not a failure of the system team; it is a risk decision.
Worked example
The SAR shows a moderate finding, and the POA&M schedules remediation in 60 days with a compensating control in the interim. The AO issues an ATO with conditions and a review date. Rule of thumb: the AO authorizes based on residual risk, not on a perfect score.