Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ca-6

security authorization  

assessment objective:

Determine if the organization:

ca-6(a)

assigns a senior-level executive or manager as the authorizing official for the information system;

ca-6(b)

ensures that the authorizing official authorizes the information system for processing before commencing operations;

ca-6(c)

ca-6(c)[1]

defines the frequency to update the security authorization; and

ca-6(c)[2]

updates the security authorization with the organization-defined frequency.

potential assessment methods and objects:

Examine: [select from: Security assessment and authorization policy; procedures addressing security authorization;  security authorization package (including security plan; security assessment report; plan of action and milestones; authorization statement); other relevant documents or records].

Interview: [select from: Organizational personnel with security authorization responsibilities; organizational personnel with information security responsibilities].

Test: [select from: Automated mechanisms that facilitate security authorizations and updates].