What it means
The decision is based on the system security and privacy plans, assessment results, remediation plans, residual risk, dependencies, and monitoring strategy. It may include conditions, limitations, or an expiration date.
Why it matters
Authorization makes risk acceptance explicit and accountable rather than allowing a system to operate by default because deployment work is complete.
Practical focus
- Present a complete and current authorization package
- State residual risks and unresolved findings clearly
- Document conditions and monitoring expectations
- Reauthorize after significant change or expiration
Common mistakes
- Treating authorization as a paperwork milestone
- Hiding material findings from the decision maker
- Assuming approval transfers responsibility
- Continuing operations after conditions are no longer met
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: