Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > REAUTHORIZATION

REAUTHORIZATION

Reauthorization actions occur at the discretion of the authorizing official in accordance with
federal or organizational policy.156 If a reauthorization action is required, organizations maximize
the use of security and privacy risk information produced as part of the continuous monitoring
processes currently in effect. Reauthorization actions, if initiated, can be either time-driven or
event-driven. Time-driven reauthorizations occur when the authorization termination date is
reached (if one is specified). If the system is under ongoing authorization,157 a time-driven
reauthorization may not be necessary. However, if the continuous monitoring program is not
sufficiently comprehensive to fully support ongoing authorization, a maximum authorization
period can be specified by the authorizing official. Authorization termination dates are guided
and informed by federal and organizational policies and by the requirements of authorizing
officials.
Under ongoing authorization, a reauthorization may be necessary if an event occurs that
produces risk above the acceptable organizational risk tolerance. A reauthorization may be
warranted, for example, if there is a breach/incident or failure of or significant problems with
the continuous monitoring program. Reauthorization actions may necessitate a review of and
changes to the continuous monitoring strategy which may in turn, affect ongoing authorization.
For security and privacy assessments associated with reauthorization, organizations leverage
security and privacy information generated by the continuous monitoring program and fill in
gaps with manual assessments. Organizations may supplement automatically-generated
assessment information with manually-generated information in situations where an increased
level of assurance is needed. If the security control assessments are conducted by qualified
assessors with the necessary independence, use appropriate security standards and guidelines,
and are based on the needs of the authorizing official, the assessment results can be applied to
the reauthorization.158
The senior agency official for privacy is responsible for assessing privacy controls and those
assessment results can be cumulatively applied to the reauthorization. Independent assessors
may assess privacy controls at the discretion of the organization. The senior agency official for
privacy reviews and approves the authorization packages for information systems that process
PII prior to the authorizing official making a reauthorization decision. The reauthorization action
may be as simple as updating the security and privacy plans, security and privacy assessment
156 Decisions to initiate a formal reauthorization include inputs from the senior agency information security officer,
senior agency official for privacy, and senior accountable official for risk management/risk executive (function).
157 An ongoing authorization approach requires that a continuous monitoring program is in place to monitor all
implemented security controls with a frequency specified in the continuous monitoring strategy.
158 [SP 800-53A] describes the specific conditions when security information can be reused to support authorization
actions.