Chapter 6
Information System Authorization
The residual risks identified during the security control assessment are evaluated and the decision is made to authorize the system to operate, deny its operation, or remediate the deficiencies. Associated documentation is prepared and/or updated depending on the authorization decision.
Certified Authorization Professional (CAP®) Candidate Information Bulletin, November 2010
Topics
- System Authorization Decision Making
- Essential System Authorization Documentation
- NIST Guidance on Authorization of Information Systems
Objectives
As a Certified Authorization Professional (CAP®), you are expected to
- Develop plan of action and milestones (POA&M)
- Assemble security authorization package
- Determine risk
Get Official (ISC)2® Guide to the CAP® CBK®, 2nd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
