DATASHEET

Archer Assessment &Authorization®

Use Case for Public Sector Solutions
The Challenge

Government agencies have struggled for years to meet basic requirements for Federal
Information Security Management Act (FISMA) reporting and Office of Management and Budget(OMB) compliance. Budget constraints have created reactive, just-in-time responses to theseresource-intensive activities. Attention is focused only on the next-to-expire Authorization toOperate (ATO) and Plan of Action & Milestones (POA&M) and migration to new control catalogs
is often postponed as long as possible.
Agencies have basic defect identification and remediation capabilities but assess controls
infrequently since they have no in-house assessment resources. Organizations hire costly outside
vendors and fund just one or two assessments in advance. Compliance and expiration dates
drive decisions more than real risk metrics, while organizations contemplate how to comply
with the latest continuous monitoring (CM) requirements. As a result, security artifacts andmetrics are often out of date or incomplete. Inefficient and duplicate efforts cause unneededstress on staff and further strain budgets and limit visibility and accountability in addressing
known risks. Issues fall through the cracks, deadlines are missed, and security vulnerabilities
remain open.

Overview
Archer Assessment & Authorization (A&A) enables organizations to assess and authorize all new
information systems before they are put into production to ensure operations are at an acceptablerisk level. It gives the authorization team the tools and capabilities to define authorization
boundaries, allocate, inherit and assess controls, assemble authorization packages, makeinformed authorization decisions, and determine whether each information system stays within
acceptable risk parameters. Archer A&A allows organizations to comply with FIS MA, OMB
and other regulatory requirements while improving security. This use case also integrates with
Archer Continuous Monitoring and Archer Plan of Action & Milestones (POA&M) Management
use cases to provide true Ongoing Authorization (OA) capability.
®

With Archer Assessment & Authorization, organizations can more effectively identify, manage
and mitigate issues, including common (inherited) control management, and eliminate bottlenecks
and inefficient manual processes. Reporting and authorization artifacts can be automaticallyupdated, providing key stakeholders with accurate, real-time data to enable better-informed
strategic decisions and ensure organizational compliance is maintained and effective security
measures are proactively enacted.

Benefits

Features

With Archer Assessment & Authorization, you can:• Authorization boundary definition.
• Electronic signatures and PIN authorization enable digital		 signatures and signature tracking.

• Save labor hours.
• Ensure more informed decision-making.

• Clear and justified security categorization.
• Customized control allocation and assessment.
• Authorization package creation and approval workflow.
• Informed authorization decision-making and issue		 remediation (POA&M).

• Expedite approval of records and signature tracking		 throughout the record lifecycle.
• Improve controls tracking across the organization.
• Reduce of overall IT and security risk.

• Monitoring strategy and Ongoing Authorization (OA).

About Archer
Archer is a leading provider of integrated risk management (IRM) solutions that enable customers to improve strategic decision-making
and operational resilience with a modern technology platform that supports qualitative and quantitative analysis driven by both businessand IT impacts. As true pioneers in GRC software, Archer remains solely dedicated to helping customers manage risk and compliancedomains, from traditional operational risk to emerging issues such as ESG. With over 20 years in the risk management industry, theArcher customer base represents one of the largest pure risk management communities globally, with more than 1,200 customers
including more than 50% of the Fortune 500.
Visit www.ArcherIRM.com.

@ArcherIRM

Archer Integrated Risk Management©2023 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks of ArcherTechnologies LLC in the United States and other countries. All other trademarks are the property of their respective owners. Archerbelieves the information in this document is accurate. The information is subject to change without notice. 10/23 Data Sheet.