ezesecops/rmf-ato-core huggingface dataset:
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX G > AUTHORIZATION BOUNDARIES FOR SOFTWARE APPLICATIONS

AUTHORIZATION BOUNDARIES FOR SOFTWARE APPLICATIONS

Authorization boundaries include all system elements, including hardware, firmware, and
software. Software elements include applications (e.g., database applications, customized
business applications, and web applications), middleware, and operating systems. The software
elements are included in authorization boundaries, either as part of the information system on
which the software is hosted or as a part of an application-only system or subsystem that
inherits controls from the hosting system. Software applications may depend on the resources
provided by the hosting system and as such, can leverage the controls provided by the hosting
system to help provide a foundational level of protection for the hosted applications. Additional
application-level controls are provided by the respective software applications, as needed.
Application owners coordinate with system owners to help ensure that security and privacy
requirements are satisfied among applications and hosting systems. Coordination between
system owners and application owners includes, for example, consideration for the selection,
implementation, assessment, and monitoring of controls for the applications; the effects of
changes to the applications on the security and privacy posture of the system and the
organization; and the effects of changes to the system on the hosted applications.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX G > AUTHORIZATION BOUNDARY CONSIDERATIONS

AUTHORIZATION BOUNDARY CONSIDERATIONS

COMPLEX SYSTEMS, APPLICATIONS, AND THE EFFECTS OF CHANGING TECHNOLOGIES
his appendix provides additional considerations for determining authorization boundaries
for complex systems and software applications. It also includes guidance on authorization
boundaries when organizations use external providers for their information resources. The
foundational RMF steps and tasks described in Chapter Three can be applied in all three
scenarios to help organizations manage security and privacy risks and comply with the laws,
executive orders, and OMB policies discussed in Chapter One.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > AUTHORIZATION DECISION INFORMATION

AUTHORIZATION DECISION INFORMATION

The authorization decision is transmitted from the authorizing official to system owners,
common control providers, and other key organizational officials. The authorization decision
includes the following information:
•
Authorization decision;
•
Terms and conditions for the authorization;
•
Time-driven authorization frequency or authorization termination date;
•
Events that may trigger a review of the authorization decision (if any); and
•
For common controls, the [FIPS 199] impact level supported by those controls.
The authorization decision indicates if the system is authorized to operate or authorized to be
used; or if the common controls are authorized to be provided to system owners and inherited
by organizational systems. The terms and conditions for the authorization provide any
limitations or restrictions placed on the operation of the system that must be followed by the
system owner or alternatively, limitations or restrictions placed on the implementation of
common controls that must be followed by the common control provider. If the system or
common controls are not under ongoing authorization, the termination date for the
authorization established by the authorizing official indicates when the authorization expires
and reauthorization is required. The authorization decision document is transmitted with the
original authorization package to the system owner or common control provider.146
Upon receipt of the authorization decision and authorization package, the system owner and
common control provider acknowledge, implement, and comply with the terms and conditions
of the authorization. The system owner and common control provider retain the authorization
decision and authorization package.147 The organization ensures that authorization documents
are available to organizational officials when requested. The contents of authorization packages,
including sensitive information regarding system vulnerabilities, privacy risks, and control
deficiencies, are marked and protected in accordance with federal and organizational policy.
Authorization decision information is retained in accordance with the organization's record
retention policy. The authorizing official verifies on an ongoing basis, that the terms and
conditions established as part of the authorization are being followed by the system owner and
common control provider.
146 Authorization decision documents may be digitally signed to ensure authenticity.
147 Organizations may choose to employ automated tools to support the development, distribution, and archiving of
risk management information to include artifacts associated with the authorization process.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > AUTHORIZATION DECISIONS

AUTHORIZATION DECISIONS

Authorization decisions are based on the content of the authorization package. There are four
types of authorization decisions that can be rendered by authorizing officials:
•
Authorization to operate;
135 If changes are made as a result of mitigation actions from plans of actions and milestones, system security plans
are updated accordingly.
136 In general, risk exposure is the degree to which an organization is threatened by the potential adverse effects on
organizational operations and assets, individuals, other organizations, or the Nation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > AUTHORIZATION PACKAGE

AUTHORIZATION PACKAGE

The authorization package provides a record of the results of the control assessments and
provides the authorizing official with the information needed to make a risk-based decision on
whether to authorize the operation of a system or common controls.127 The system owner or
common control provider is responsible for the development, compilation, and submission of
the authorization package. This includes information available from reports generated by an
automated security/privacy management and reporting tool. The system owner or common
control provider receives inputs from many sources during the preparation of the authorization
package (e.g., senior agency information security officer; senior agency official for privacy,
senior accountable official for risk management or risk executive [function]; control assessors;
system security or privacy officer; and the continuous monitoring program). The authorization
package128 includes the following:
•
Executive summary;
•
Security and privacy plans;129 130
127 Authorization packages for common controls that are not system-based may not include a security or privacy plan,
but do include a record of common control implementation details.
128 The authorizing official determines what additional supporting information, artifacts, or references may be
required in the authorization package. The additional documentation may include, for example, risk assessments,
contingency plans, or SCRM plans.
129 [SP 800-18] provides guidance on system security plans. Guidance on privacy plans will be addressed in a planned
publication specific to privacy plans.
130 In accordance with [OMB A-130], the information system security plan and the privacy plan may be integrated into
one consolidated document.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > Authorization to Operate

APPENDIX F

•
Common control authorization;
•
Authorization to use; and
•
Denial of authorization.

Authorization to Operate

If the authorizing official, after reviewing the authorization package, determines that the risk to
organizational operations, organizational assets, individuals, other organizations, and the Nation
is acceptable, an authorization to operate is issued for the information system. The system is
authorized to operate for a specified period in accordance with the terms and conditions
established by the authorizing official. An authorization termination date is established by the
authorizing official as a condition of the authorization. The authorization termination date can
be adjusted at any time by the authorizing official to reflect an increased level of concern
regarding the security and privacy posture of the system. For example, the authorizing official
may choose to authorize the system to operate only for a short period of time if it is necessary
to test a system in the operational environment before all controls are fully in place, (i.e., the
authorization to operate is limited to the time needed to complete the testing objectives).137
The authorizing official may choose to include operating restrictions such as limiting logical and
physical access to a minimum number of users; restricting system use time periods; employing
enhanced or increased audit logging, scanning, and monitoring; or restricting the system
functionality to include only the functions that require live testing. The authorizing official
considers results from the assessment of controls that are fully or partially implemented since if
the system is ready to be tested in a live environment, many of the controls should already be in
place. If the system is under ongoing authorization, a time-driven authorization frequency is
specified. Additionally, an adverse event could occur that triggers the need to review the
authorization to operate.138
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX F > Authorization to Use Decision

Authorization to Use Decision

The authorization to use is a streamlined version of the authorization to operate and includes:
•
A risk acceptance statement; and
•
Time- or event-driven triggers for review of the security and privacy posture of the provider
organization shared cloud or system, application, or service (if any).
An authorization to use is issued by an authorizing official from a customer organization in lieu
of an authorization to operate. The authorizing official has the same level of risk management
responsibility and authority as an authorizing official issuing an authorization to operate or a
common control authorization. The risk acceptance statement indicates the explicit acceptance
of the security and privacy risk incurred from the use of a shared system, service, or application
with respect to the customer organization information processed, stored, or transmitted by or
through the shared or cloud system, service, or application.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > AUTHORIZING OFFICIAL

AUTHORIZING OFFICIAL

The authorizing official is a senior official or executive with the authority to formally assume
responsibility and accountability for operating a system; providing common controls inherited
by organizational systems; or using a system, service, or application from an external provider.
The authorizing official is the only organizational official who can accept the security and privacy
risk to organizational operations, organizational assets, and individuals.115 Authorizing officials
typically have budgetary oversight for the system or are responsible for the mission and/or
business operations supported by the system. Accordingly, authorizing officials are in
management positions with a level of authority commensurate with understanding and
accepting such security and privacy risks. Authorizing officials approve plans, memorandums of
agreement or understanding, plans of action and milestones, and determine whether significant
changes in the information systems or environments of operation require reauthorization.
Authorizing officials coordinate their activities with common control providers, system owners,
chief information officers, senior agency information security officers, senior agency officials for
privacy, system security and privacy officers, control assessors, senior accountable officials for
risk management/risk executive (function), and other interested parties during the authorization
process. With the increasing complexity of the mission/business processes in an organization,
partnership arrangements, and the use of shared services, it is possible that a system may
112 Organizations may define other roles to support the risk management process.
113 Organizations ensure that there are no conflicts of interest when assigning the same individual to multiple risk
management roles. See RMF Prepare-Organization Level step, Task P-1.
114 For example, the SDLC role of system developer or program manager can be aligned with the role of system
owner; and the role of mission or business owner can be aligned with the role of authorizing official. [SP 800-64]
provides guidance on information security in the SDLC.
115 The responsibility and accountability of authorizing officials described in [FIPS 200] was extended in [SP 800-53] to
include risks to other organizations and the Nation.
T
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX D > AUTHORIZING OFFICIAL DESIGNATED REPRESENTATIVE

AUTHORIZING OFFICIAL DESIGNATED REPRESENTATIVE

The authorizing official designated representative is an organizational official designated by the
authorizing official who is empowered to act on behalf of the authorizing official to coordinate
and conduct the day-to-day activities associated with managing risk to information systems and
organizations. This includes carrying out many of the activities related to the execution of the
RMF. The only activity that cannot be delegated by the authorizing official to the designated
representative is the authorization decision and signing of the associated authorization decision
document (i.e., the acceptance of risk).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER ONE

•
Facilitates the categorization of information and systems, the selection, implementation,
assessment, and monitoring of controls, and the authorization of information systems and
common controls;11
•
Promotes the use of automation for near real-time risk management and ongoing system
and control authorization through the implementation of continuous monitoring processes;
•
Encourages the use of correct and timely metrics to provide senior leaders and managers
with the necessary information to make cost-effective, risk-based decisions for information
systems supporting their missions and business functions;
•
Facilitates the integration of security and privacy requirements12 and controls into
enterprise architecture,13 SDLC, acquisition processes, and systems engineering processes;
•
Connects risk management processes at the organization and mission/business process
levels to risk management processes at the information system level through a senior
accountable official for risk management and risk executive (function);14 and
•
Establishes responsibility and accountability for controls implemented within information
systems and inherited by those systems.
The RMF provides a dynamic and flexible approach to effectively manage security and privacy
risks in diverse environments with complex and sophisticated threats, evolving missions and
business functions, and changing system and organizational vulnerabilities. The framework is
policy and technology neutral, which facilitates ongoing upgrades to IT resources15 and to IT
modernization efforts-to support and help ensure essential missions and services are provided
during such transition periods.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER ONE

•
To facilitate the integration of security and privacy requirements and controls into the
enterprise architecture, SDLC processes, acquisition processes, and systems engineering
processes;17 and
•
To facilitate the implementation of the Framework for Improving Critical Infrastructure
Cybersecurity [NIST CSF] within federal agencies.18
This publication is intended to help organizations19 manage security and privacy risk and to
satisfy the requirements in the Federal Information Security Modernization Act of 2014 [FISMA],
the Privacy Act of 1974 [PRIVACT], OMB policies, and designated Federal Information Processing
Standards, among other laws, regulations, and policies.
The scope of this publication pertains to federal information systems, which are discrete sets of
information resources organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition of information, whether such information is in digital or non-digital
form. Information resources include information and related resources, such as personnel,
equipment, funds, and information technology. The guidelines have been developed from a
technical perspective to complement guidelines for national security systems and may be used
for such systems with the approval of appropriate federal officials with policy authority over
such systems. State, local, and tribal governments, as well as private sector organizations are
encouraged to use these guidelines, as appropriate.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER ONE

•
Individuals with logistical or disposition-related responsibilities (e.g., program managers,
procurement officials, system integrators, and property managers).
For a comprehensive list and description of roles and responsibilities associated with the RMF,
see Appendix D.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE

Potential Inputs: Security and privacy assessment reports; organization- and system-level risk assessment
results; security and privacy plans; plans of action and milestones.
Expected Outputs: Mitigation actions or risk acceptance decisions; updated security and privacy
assessment reports.
Primary Responsibility: Authorizing Official; System Owner; Common Control Provider.
Supporting Roles: Senior Accountable Official for Risk Management or Risk Executive (Function); Senior
Agency Official for Privacy; Authorizing Official Designated Representative; Information Owner or
Steward; System Security Officer; System Privacy Officer; Systems Security Engineer; Privacy Engineer;
Security Architect; Privacy Architect.
System Development Life Cycle Phase: New - Operations/Maintenance.
Existing - Operations/Maintenance.
Discussion: Assessment information produced by an assessor during continuous monitoring is provided
to the system owner and the common control provider in updated assessment reports or via reports from
automated security/privacy management and reporting tools. The authorizing official determines the
appropriate risk response to the assessment findings or approves responses proposed by the system
owner and common control provider. The system owner and common control provider subsequently
implement the appropriate risk response. When the risk response is acceptance, the findings remain
documented in the security and privacy assessment reports and are monitored for changes to risk factors.
When the risk response is mitigation, the planned mitigation actions are included in and tracked using the
plans of action and milestones. If requested by the authorizing official, control assessors may provide
recommendations for remediation actions. Recommendations for remediation actions may also be
provided by an automated security/privacy management and reporting tool. An organizational
assessment of risk (Task P-3) and system-level risk assessment results (Task P-14) guide and inform the
decisions regarding ongoing risk response. Controls that are modified, enhanced, or added as part of
ongoing risk response are reassessed by assessors to ensure that the new, modified, or enhanced controls
have been implemented correctly, are operating as intended, and producing the desired outcome with
respect to meeting the security and privacy requirements of the system.
References: [SP 800-30]; [SP 800-53]; [SP 800-53A]; [SP 800-137]; [SP 800-160 v1] (Risk Management
Process); [IR 8011 v1]; [IR 8062]; [NIST CSF] (Core [Respond Function]).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE

Discussion: To achieve near real-time risk management, the organization updates security and privacy
plans, security and privacy assessment reports, and plans of action and milestones on an ongoing basis.
Updates to the plans reflect modifications to controls based on risk mitigation activities carried out by
system owners or common control providers. Updates to control assessment reports reflect additional
assessment activities carried out to determine control effectiveness based on implementation details in
the plans. Plans of action and milestones are updated based on progress made on the current outstanding
items; address security and privacy risks discovered as part of control effectiveness monitoring; and
describe how the system owner or common control provider intends to address those risks. The updated
information raises awareness of the security and privacy posture of the system and the common controls
inherited by the system, thereby, supporting near real-time risk management and the ongoing
authorization process.
The frequency of updates to risk management information is at the discretion of the system owner,
common control provider, and authorizing officials in accordance with federal and organizational policies
and is consistent with the organizational and system-level continuous monitoring strategies. The updates
to information regarding the security and privacy posture of the system and the common controls
inherited by the system are accurate and timely since the information provided influences ongoing
actions and decisions by authorizing officials and other senior leaders within the organization. The use of
automated support tools and organization-wide security and privacy program management practices
ensure that authorizing officials can readily access the current security and privacy posture of the system.
Ready access to the current security and privacy posture supports continuous monitoring and ongoing
authorization and promotes the near real-time management of risk to organizational operations and
assets, individuals, other organizations, and the Nation.
Organizations ensure that information needed for oversight, management, and auditing purposes is not
modified or destroyed when updating security and privacy plans, assessment reports, and plans of action
and milestones. Providing an effective method to track changes to systems through configuration
management procedures is necessary to achieve transparency and traceability in the security and privacy
activities of the organization; to obtain individual accountability for any security or privacy actions; and to
understand emerging trends in the security and privacy programs of the organization.
References: [SP 800-30]; [SP 800-53A].