Why would the authorization decision issue a determination of Not Authorized? Response:

Whether a system processes classified information or not is part of its categorization and requirements, not the sole reason for a "Not Authorized" decision unless it directly contributes to unacceptable risk. "NA" in the context of classified information is not directly related to an overall system authorization determination.

An authorization decision of "Not Authorized" is issued when the Authorizing Official (AO) determines that the residual risk to the agency, based on the system's security posture and mission impact, is unacceptably high. This indicates that the identified risks outweigh the benefits of operating the system in its current state.

If a system is mission critical and requires an interim authority to operate (IATO), it suggests a temporary authorization with conditions, not a complete denial ("Not Authorized"). An IATO is a conditional authorization, not a refusal.

It is incorrect to assume an information system is always accredited without restrictions; accreditation is a risk-based decision and can include conditions or even denial of authorization.