System Compliance
The authorization decision
The authorization package typically contains the security plan, the assessment report, the POA&M, and the continuous monitoring plan. The authorizing official reviews residual risk and issues an authorization to operate, an authorization with conditions, or a denial. The assessor describes risk; the system owner manages it; the authorizing official accepts it. Trap: any answer that gives the assessor the decision, or that assumes an authorization is permanent and unconditional.
Ongoing authorization
Compliance is maintained through monitoring: control retesting on a defined cadence, tracking of significant changes, vulnerability and patch status, incident trends, and periodic reporting. Reauthorization or re-assessment is triggered by major changes (new interconnection, architecture change, new data type), significant incidents, new threats, expiring authorizations, or changes in law or regulation.
Managing gaps honestly
A POA&M records the weakness, the planned remediation, milestones, an owner, a due date, and a risk rating, and it is reviewed at governance level. Where risk is accepted rather than fixed, document the rationale, the accepting authority, and an expiry; waivers and exceptions follow the same discipline. Trap: closing a POA&M by rewording the finding rather than fixing the condition.
Reporting to the top
Compliance status should be expressed in metrics leadership can act on: percentage of controls tested, overdue remediation, aging exceptions, open critical findings, and scan coverage. Dashboards and audit trails demonstrate that oversight actually happens.
Rule of thumb: remember the division of labor - the assessor describes, the system owner manages, the authorizing official accepts, and governance oversees. Most scenario questions are resolved by identifying which of these four the actor is performing.
Never let a compliance deadline substitute for a risk decision.