Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > Authorization to Use

Authorization to Use

An authorization to use is employed when an organization (hereafter referred to as the
customer organization) chooses to accept the information in an existing authorization package
produced by another organization (either federal or nonfederal) for an information system that
is authorized to operate by a federal entity (referred to as the provider organization).140 The
authorization to use is a mechanism to promote reciprocity for systems under the purview of
different authorizing officials. An authorization to use is issued by an authorizing official from
the customer organization instead of an authorization to operate. The official issuing an
authorization to use has the same level of responsibility and authority for risk management as
an authorizing official issuing an authorization to operate or a common control authorization.141
The acceptance of the information in the authorization package from the provider organization
is a form of reciprocity and is based on a need to use shared systems, services, or applications. A
customer organization can issue an authorization to use only after a valid authorization to
operate has been issued by another federal entity (i.e., the provider organization).142 The
authorization to operate by the provider organization is a statement of acceptance of risk for
the system, service, or application being provided. The authorization to use by the customer
organization is a statement of the acceptance of risk in using the system, service, or application
with respect to the customer's information. An authorization to use provides opportunities for
significant cost savings and avoids a potentially costly and time-consuming authorization process
by the customer organization.
An authorization to use requires the customer organization to review the authorization package
from the provider organization as the fundamental basis for determining risk.143 When
139 In certain situations, system owners may choose to inherit controls from other organizational systems that may
not be designated officially as common controls. System owners inheriting controls from other than approved
common control providers ensure that the systems providing such controls have valid authorizations to operate. The
authorizing official of the system inheriting the controls is also made aware of the inheritance.
140 The term provider organization refers to the federal agency or subordinate organization that provides a shared
system, service, or application and/or owns and maintains the authorization package (i.e., has granted an
Authorization to Operate for the shared system, service, or application). The shared system, service, or application
may not be owned by the organization that owns the authorization package, for example, in situations where the
shared system, service, or application is provided by an external provider.
141 Risk-based decisions related to control selection and baseline tailoring actions by organizations providing cloud or
shared systems, services, or applications should consider the protection needs of the customer organizations that
may be using those cloud or shared systems, services, or applications. Thus, organizations hosting cloud or shared
systems, services, or applications should consider the shared risk of operating in those types of environments.
142 A provisional authorization (to operate) issued by the General Services Administration (GSA) as part of the Federal
Risk and Authorization Management Program (FedRAMP) is considered a valid authorization to operate for customer
organizations desiring to issue an authorization to use for cloud-based systems, services, or applications.
143 The sharing of the authorization package (including security and privacy plans, security and privacy assessment
reports, plans of action and milestones, and the authorization decision document) is accomplished under terms and
conditions agreed upon by all parties (i.e., the customer organization and the service provider organization).