Ongoing Authorization In Summary Q4-2024
- Under OA, ATO is not set to expire after 3 years but only expire base on the occurrence of a predefined event. Example: New threat/vulnerability, increase in number of weaknesses, change in Authorizing Official (AO), new business mission/requirement or significant operational or inventory change
- OA is event driven and time driven
- Time Driven security report are reviewed frequently (for example: Weekly for High system, Bi Weekly for Moderate system and monthly for Low system)
- Event Driven: the following events might require a comprehensive SCA to be conducted and a new ATO issued: New threat/vulnerability, increase in number of weaknesses, change in Authorizing Official (AO), new business mission/requirement or significant operational or inventory change
- OA is dynamic, near real-time ongoing authorization process as oppose to a static, point in time authorization process
- OA is fundamentally related to the ongoing understanding and ongoing acceptance of information security risk
- OA is affected by the ISCM strategy defined under Phase Six of the RMF (Continuous Monitoring)
Condition to implement OA
- Initial authorization needs to be completed
- The organization need to develop an Information Security Continuous Monitoring (ISCM) strategy
- The AO needs to be documented by the AO
- Creation of the SA&A package (SSP, SAR, and POAM) need to be automated although the data feed can be manual or procedural but this information needs to be available to the AO via an automated manner
- POAM items/weaknesses are near real time (event and time driven)
- Frequency of assessment and reporting are defined in the ISCM strategy and program
| PHASE | DEVILEVABLES | PUBLICATIONS | LIFE CYCLE | RESPONSIBLE |
| CATEGORIZATION | System Of Records Notice (SORN), E-Authentication, FIPS199, Risk Assessment Report, Privacy Threshold Analysis (PTA), Privacy Impact Analyst(PIA), PTWA, OMB Number | FIPS200, FIPS199, SP-800-60, SP-800-30, SP800-37, SP 800-39, SP800-63 | Initiation | ISSO, C&A Analyst, Information owner, System Owner |
| CONTROL SELECTON | System Security Baseline Control | SP 800-53, FIPS 200 | Initiation / Development / Acquisition | ISSO, C&A Analyst, System Owner |
| IMPLEMENTATON OF CONTROL | System Security Plan(SSP), Configuration Management Plan(CMP), Contingency Plan (CP),Contingency Plan Test | SP 800-18, SP 800- 53, SP 800-128, FIPS 200, SP 800-70, SP 800-34, SP 800-84 | Development Acquisition/ Implementation | ISSO, System Owner |
| ASSESSING CONTROL | Security Test Plan , System Security Plan(SSP), Security Assessment Report (SAR), Security Test Evaluation (ST&E) Report | SP 800-53, SP 800– 53A, SP 800-18 | Development/ Acquisition | C&A Analyst |
| AUTHORIZING | System Security Plan(SSP), PlanOf Acton and Milestone (POA&M), Security Assessment Report(SAR), Authorization To Operate(ATO) | SP 800-53, SP 800- 53A, SP 800-18, SP-800-30, SP 800-37, SP800-39 | Implementation | AO, ISSO, C&A Analyst, System Owner |
| CONTINUOUS MONITORING | System Security Plan(SSP), Plan Of Acton and Milestone (POA&M), Security Assessment Report (SAR), Annual Assessment Letter | SP 800-53, SP 800- 53A, SP 800-18, SP800-30, SP 800-137 | Maintenance/ Operation | AO, ISSO, C&A Analyst, System Owner |
