Assessment Objective
Determine if:
- CA-06a. a senior official is assigned as the authorizing official for the system;
- CA-06b. a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems;
- CA-06c.
- CA-06c.01 before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system;
- CA-06c.02 before commencing operations, the authorizing official for the system authorizes the system to operate;
- CA-06d. the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
- CA-06e. the authorizations are updated [Assignment: frequency].
Assessment Methods
Examine
- Assessment, authorization, and monitoring policy
- procedures addressing authorization
- system security plan, privacy plan, assessment report, plan of action and milestones
- authorization statement
- other relevant documents or records
Interview
- Organizational personnel with authorization responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms that facilitate authorizations and updates
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | CA-06 [H] Authorization |