CAP · Question #286
An Authorizing Official plays the role of an approver. What are the responsibilities of an Authorizing Official? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is B. Determining the requirement of reauthorization and reauthorizing information systems when C. Reviewing security status reports and critical security documents D. Ascertaining the security posture of the organization's information system. An Authorizing Official reviews security documents, determines reauthorization needs, and assesses system security posture, but does not establish the continuous monitoring program.
Question
An Authorizing Official plays the role of an approver. What are the responsibilities of an Authorizing Official? Each correct answer represents a complete solution. Choose all that apply.
Options
- AEstablishing and implementing the organization's continuous monitoring program
- BDetermining the requirement of reauthorization and reauthorizing information systems when
- CReviewing security status reports and critical security documents
- DAscertaining the security posture of the organization's information system
How the community answered
(17 responses)- A12% (2)
- B88% (15)
Why each option
An Authorizing Official reviews security documents, determines reauthorization needs, and assesses system security posture, but does not establish the continuous monitoring program.
Establishing and implementing the continuous monitoring program is the responsibility of the Information System Security Officer (ISSO) or the security operations team, not the Authorizing Official.
The AO determines when reauthorization is required based on changes in threat environment or system configuration and formally reauthorizes systems after a risk review.
The AO reviews security status reports and critical security documents such as security assessment reports and plans of action and milestones to make risk-based authorization decisions.
The AO is ultimately responsible for accepting the security posture of the organization's information system before granting an Authorization to Operate (ATO).
Concept tested: NIST RMF Authorizing Official roles and responsibilities
Source: https://csrc.nist.gov/glossary/term/authorizing_official
Topics
Community Discussion
No community discussion yet for this question.