Before a system goes live, someone senior should say, in writing, "we accept the risk of running this." CA-6 calls that person the authorizing official.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. NIST's guidance says authorization is a federal responsibility and authorizing officials must be federal employees. Outside government you cannot copy the role literally, but you can show the same decision.
What the control asks
Assign a senior official as authorizing official for the system and another for common controls that systems inherit. Make sure the official for the system, before operations begin, accepts the use of common controls and authorizes the system to operate. Make sure the common controls official authorizes those controls for inheritance. Update authorizations at a frequency you define.
The enhancements, CA-6.1 Joint Authorization, Intra-organization and CA-6.2 Joint Authorization, Inter-organization, cover cases with more than one official.
What it means in practice
In a company, the equivalent is a documented risk acceptance by an executive who owns the risk and the budget: the CTO, CISO or CEO. They review the assessment results and the open POA&M, then sign.
Evidence to collect
- A named accountable executive for each system.
- A signed authorization or risk acceptance memo with date.
- The assessment summary and POA&M reviewed at signing.
- A re-authorization record when the system changes or on a schedule.
- A description of common controls and who approves inheriting them.
Common gaps
- Go-live decided by the engineering team with no sign off.
- Sign off with no assessment results attached.
- Authorization never renewed after big changes.
How to implement it
Use a one page template: system, scope, residual risks, decision, approver, expiry date. Pair it with your risk register so accepted risks are visible.
Click through it at your own pace, or open it full screen.
Quick check
Must the approver be a federal employee for us?
Only in federal programs. Elsewhere, pick an executive with real authority over the risk.
