The Authorization Decision Nobody Can Sign

Not by the system owner. Risk acceptance for a High finding and the authorization decision rest with the authorizing official, or a formally designated delegate. The system owner recommends and signs the POA&M; they do not accept residual risk on the AO's behalf, and the pressure of a mission window does not transfer authority.

Viable paths, in order of preference:

1. Locate the delegation of authority. Most agencies name an alternate or delegate for absences. Confirm it is current and covers authorization decisions, then route to that person. This is usually the fastest and cleanest route.
2. Request a constrained authorization from the AO or delegate - explicit limits on use, compensating controls as conditions, a defined expiration, and monitoring requirements. The decision memo records the accepted risk and the conditions.
3. Escalate through the CIO or risk executive if no delegate exists and the AO is unreachable, so the decision is made by someone with authority rather than absorbed by default.

Note that the POA&M as written is also non-compliant: 11 months for a High finding contradicts the 30-day policy. That has to be addressed regardless of who signs.

A compensating control must address the same threat as the missing control, provide protection of comparable strength, and be shown to operate - not merely exist on a diagram.

Threat being addressed: credential compromise of highly privileged accounts. The compensating package must show:

• Enforcement, not configuration. The jump host requires hardware-token authentication for all 14 accounts, with a current report from the authentication system showing every one of the 14 enrolled and no bypass path.
• Reachability. The management VLAN is not reachable from user networks or the internet; a network diagram plus a recent scan or rule export demonstrating the restriction.
• Credential hygiene. No shared or generic accounts among the 14, individual attribution, and session logging with alerting on anomalous console activity that someone actually reviews.
• Breadth of coverage. What the compensating control does not cover - for example, direct console access that bypasses the jump host, or the legacy console's own authentication.
• Time bound. The control holds only until replacement; the POA&M must carry a credible date and interim milestones.

If the evidence shows the residual risk remains High after these measures, the AO may still accept it - but that is a documented business decision, not a technical conclusion the team can assert.

This is worth taking seriously because it eliminates the finding rather than accepting it, which is a better outcome than any risk acceptance. But it must be tested before it is offered as the basis for a decision.

Questions that determine whether it works:

• What breaks? If the 14 accounts perform administrative functions the system needs - patching, batch recovery, emergency access - disabling them removes capability, and an outage during the mission window is a worse outcome than the finding.
• Is there a break-glass path? If emergency access is needed, the replacement accounts inherit the same MFA gap. Disabling 14 accounts and creating 2 exceptions does not reduce risk.
• Is it reversible under pressure? Under incident pressure, accounts get re-enabled without the control. If the only barrier is a spreadsheet, this is a paper fix.

If the functions can genuinely be absorbed by accounts that do enforce MFA, then document the change, re-test the control, and the finding closes on evidence - a much stronger position for the AO than a compensating-control argument. If not, fall back to the constrained authorization path.