DATA SHEET

Archer Assessment & Authorization®

Use Case for Public Sector Solutions

The Challenge
Government agencies have struggled for years to meet basic requirements for Federal
Information Security Management Act (FISMA) reporting and Office of Management
and Budget (OMB) compliance. Budget constraints have created reactive, just-in-time
responses to these resource-intensive activities. Attention is focused only on the nextto-expire Authorization to Operate (ATO) and Plan of Action & Milestones (POA&M)
and migration to new control catalogs is often postponed as long as possible.
Agencies have basic defect identification and remediation capabilities but assess controls
infrequently since they have no in-house assessment resources. Organizations hire costly
outside vendors and fund just one or two assessments in advance. Compliance and expiration
dates drive decisions more than real risk metrics, while organizations contemplate how tocomply with the latest continuous monitoring (CM) requirements. As a result, security
artifacts and metrics are often out of date or incomplete. Inefficient and duplicate efforts
cause unneeded stress on staff and further strain budgets and limit visibility andaccountability in addressing known risks. Issues fall through the cracks, deadlines are
missed, and security vulnerabilities remain open.

Overview
Archer Assessment & Authorization (A&A) enables organizations to assess and authorize
all new information systems before they are put into production to ensure operations
are at an acceptable risk level. It gives the authorization team the tools and capabilities
to define authorization boundaries, allocate, inherit and assess controls, assemble
authorization packages, make informed authorization decisions, and determine whether
each information system stays within acceptable risk parameters. Archer A&A allows
organizations to comply with FIS MA, OMB and other regulatory requirements while
improving security. This use case also integrates with Archer Continuous Monitoringand Archer Plan of Action & Milestones (POA&M) Management use cases to provide
true Ongoing Authorization (OA) capability.
®

With Archer Assessment & Authorization, organizations can more effectively identify,
manage and mitigate issues, including common (inherited) control management, andeliminate bottlenecks and inefficient manual processes. Reporting and authorization
artifacts can be automatically updated, providing key stakeholders with accurate,
real-time data to enable better-informed strategic decisions and ensure organizational
compliance is maintained and effective security measures are proactively enacted.

Key Features
 Authorization boundary definition.
 Electronic signatures and PIN
authorization enable digital
signatures and signature tracking.
 Clear and justified security
categorization.
 Customized control allocation
and assessment.
 Authorization package creation
and approval workflow.
 Informed authorization
decision-making and issueremediation (POA&M).
 Monitoring strategy and Ongoing
Authorization (OA).

Key Benefits
With Archer Assessment &Authorization, organizations can: Save labor hours.
 Ensure more informed
decision-making.
 Expedite approval of records andsignature tracking throughout therecord lifecycle.
 Improve controls tracking acrossthe organization.
 Reduce of overall IT and security risk.

Discover More
Archer is a leading provider of integrated risk management (IRM) solutions that enable customers to improve strategic decisionmaking and operational resilience with a modern technology platform that supports qualitative and quantitative analysis driven
by both business and IT impacts. As true pioneers in GRC software, Archer remains solely dedicated to helping customers managerisk and compliance domains, from traditional operational risk to emerging issues such as ESG. With over 20 years in the risk
management industry, the Archer customer base represents one of the largest pure risk management communities globally, withmore than 1,200 customers including more than 50% of the Fortune 500.

©2022 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks of ArcherTechnologies LLC in the United States and other countries. All other trademarks are the property of their respective owners. Archerbelieves the information in this document is accurate. The information is subject to change without notice. 11/22 Data Sheet.