Term
| What are the RMF Authorization Types? |
|
Definition
- Authorizatoin to Operate (ATO)
- ATO with conditions (approved only by DoD Component Chief Information Officer (CIO))
- Interim Authority to Test (IATT)
- Denial of Authorization to Operate (DATO)
|
|
|
Term
| What is the Decision Criteria and Authorization Period for Authorizatoin to Operate (ATO)? |
|
Definition
- Decision Criteria
- Overall risk determined to acceptable
- No NC controls with risk level "Very High" or "High"
Authorization Period
- Must specify an Authorization Termination Date (ATD) that is within 3 years of the authorization date unless the IS or PIT system has a system-level, DoD policy compliant ,continuous monitoring program.
|
|
|
Term
| What is the Decision Criteria and Authorization Period for ATO with conditions? |
|
Definition
Decision Criteria
NC controls with "Very High" or "High" risk cant be corrected or mitigated immediately, but overall system risk is determined to be acceptable due to mission criticality
Authorization Period
Should specify an AO review period that is within 6 months of the authorization date. If the system still operates with a level "Very High" or "High" after 1 one year, the DoD Component CIO must reapprove.
|
|
|
Term
| What is the Decision Criteria and Authorization Period for Interim Authority To Test (IATT)? |
|
Definition
Decision Criteria
Risk determination is being made to permit testing of the system in an operational information environment or with live data, and the risk is acceptable.
Authorization Period
Should expire at the completion of testing (normally a period of less than 90 days) |
|
|
Term
| What is the Decision Criteria and Authorization Period for Denial of Authorizatoi to Operate (DATO)? |
|
Definition
Decision Criteria
Risk is determined to be unacceptable
Authorization Period
Immediate or in concert witha system decommissioning strategy |
|
|
