CGRC · Question #101
An authorization approach where a single organizational official in a senior leadership position is responsible and accountable for a system or common controls is referred to as: Response:
The correct answer is B. Traditional authorization. This question describes a "traditional authorization" approach where a single senior official holds responsibility and accountability for system authorization.
Question
An authorization approach where a single organizational official in a senior leadership position is responsible and accountable for a system or common controls is referred to as:
Response:
Options
- AJoint authorization
- BTraditional authorization
- CSite authorization
- DSingle authorization
How the community answered
(41 responses)- A7% (3)
- B88% (36)
- C2% (1)
- D2% (1)
Why each option
This question describes a "traditional authorization" approach where a single senior official holds responsibility and accountability for system authorization.
Joint authorization involves multiple authorizing officials sharing responsibility for a system, which contradicts the "single official" description.
Traditional authorization involves a single authorizing official (AO) taking full responsibility for the security posture and authorization decision of an information system or its common controls. This approach consolidates accountability under one senior leader, fitting the description of a single organizational official.
Site authorization typically refers to authorizing a group of systems at a specific location, not necessarily the structure of accountability by a single official.
Single authorization is a term that could be confused with traditional authorization but is not the established terminology in cybersecurity frameworks like NIST RMF for this specific approach.
Concept tested: Authorization approaches and AO responsibility.
Source: https://csrc.nist.gov/glossary/term/authorizing_official
Topics
Community Discussion
No community discussion yet for this question.