-: Now, in this video, 2 2
we're going to continue on to Step 6, 3 3
which is called Authorize. 4 4
The goal of Step 6 is to create a culture of accountability 5 5
in your organization by requiring senior management 6 6
to determine which risks can be accepted 7 7
and which ones cannot. 8 8
There are five tasks here in step number six. 9 9
Now, let's take a look at each one. 10 10
When you complete Task R-1, 11 11
your organization will have an authorization package 12 12
with an executive summary. 13 13
The authorization package could be created manually 14 14
or it could be automatically generated 15 15
from a security or privacy management tool 16 16
and then submitted to your authorizing official. 17 17
But what's inside an authorization package? 18 18
The authorization package includes security 19 19
and privacy plans, assessment reports, plans of action, 20 20
and milestones and an executive summary. 21 21
The authorization package will then be handed over 22 22
to the authorizing official for their review and approval. 23 23
Additional information can be included 24 24
if your authorizing official requests it. 25 25
Make sure to maintain version 26 26
and change control of your authorization packages. 27 27
By the end of Task R-2, 28 28
you'll have a risk determination that has been decided on 29 29
by your organization's authorizing official. 30 30
The authorizing official, in collaboration 31 31
with your information security officer and privacy officer, 32 32
will analyze the information in the authorization package 33 33
and will finalize the risk management approach. 34 34
And when you finish the next task, R-3, 35 35
your organization will have a clear set of responses 36 36
for the risks that were documented in the previous task. 37 37
After risk determination, 38 38
your organization can do one of two things, 39 39
you can either accept the risk, that is to not do anything 40 40
and hope that nothing bad happens, 41 41
or you can mitigate the risk. 42 42
It may be appropriate to accept a risk 43 43
if the cost to mitigate it would be higher 44 44
than the possible harm the risk could cause. 45 45
When accepting a risk, make sure to keep documentation of it 46 46
and continue to monitor the source of the risk 47 47
for any changes. 48 48
However, please remember that the only person 49 49
who can approve of a risk being mitigated or accepted 50 50
is the authorizing official. 51 51
When mitigating a risk, your planned mitigation 52 52
should be included in and tracked using your POAM, 53 53
which stands for Plan of Action and Milestones. 54 54
Once mitigated, your assessment team 55 55
will reassess the controls in play, 56 56
then update the assessment reports 57 57
without getting rid of the original ones. 58 58
When you complete Task R-4, 59 59
your new system will either have an authorization 60 60
or a denial from your authorizing official. 61 61
Again, no one besides the authorizing official 62 62
should be able to approve or deny the authorization 63 63
to operate your system. 64 64
You can expect that the authorizing official will talk 65 65
with your senior risk management officer 66 66
before making the final authorization decision 67 67
for the system and it's controls. 68 68
Once decided, your authorizing official 69 69
will tell the system owner or the common control provider 70 70
of their decision along with the terms and conditions 71 71
for the system to operate with authorization. 72 72
They will also set the authorization termination date, 73 73
which is when the system will no longer be authorized 74 74
and will need to be reviewed once again. 75 75
Finally, when you finish Task R-5, 76 76
you'll have a report that states the authorization decision 77 77
for your system or set of common controls 78 78
along with an annotation of its authorization status 79 79
in your organization's system registry.