nerdexam
(ISC)2

CGRC · Question #79

The authorization decision document conveys the final security authorization decision from the authorizing official to the information system owner. The authorization decision document contains all of

The correct answer is C. Approving revisions to the SSAA. The authorization decision document includes the final authorization decision, terms, conditions, and termination date, but it does not approve revisions to the System Security Authorization Agreement (SSAA). The SSAA is a separate document that outlines the agreement between par

Security and Privacy Governance, Risk Management, and Compliance Program

Question

The authorization decision document conveys the final security authorization decision from the authorizing official to the information system owner. The authorization decision document contains all of the following information except? Response:

Options

  • AAuthorization decision
  • BTerms and conditions for the authorization
  • CApproving revisions to the SSAA
  • DAuthorization termination date

How the community answered

(36 responses)
  • A
    6% (2)
  • B
    3% (1)
  • C
    89% (32)
  • D
    3% (1)

Why each option

The authorization decision document includes the final authorization decision, terms, conditions, and termination date, but it does not approve revisions to the System Security Authorization Agreement (SSAA). The SSAA is a separate document that outlines the agreement between parties regarding security.

AAuthorization decision

The "Authorization decision" is a core component of the authorization decision document.

BTerms and conditions for the authorization

"Terms and conditions for the authorization" are crucial details included in the authorization decision document.

CApproving revisions to the SSAACorrect

The authorization decision document typically conveys the final decision, specific terms and conditions for authorization, and an authorization termination date. Approving revisions to the System Security Authorization Agreement (SSAA) is a distinct process or document, separate from the authorization decision itself.

DAuthorization termination date

An "Authorization termination date" is a standard element of an authorization decision, indicating its validity period.

Concept tested: RMF - Authorization Decision Document contents

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#Authorization Decision Document#Risk Management Framework (RMF)#System Authorization#Authorizing Official (AO)

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice