NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PM-10, Authorization Process, has three parts. Manage the security and privacy state of systems and their environments through authorization processes. Designate individuals to fulfill specific roles and responsibilities within the risk management process. Integrate the authorization processes into an organization wide risk management program.
The guidance names a risk executive (function) and designated authorizing officials for each system and common control provider. It says authorization processes should be integrated with continuous monitoring so risk acceptance stays current.
What it means in practice
In federal work an authorizing official signs an authority to operate. Outside that world the same idea shows up as a go live approval: an accountable person reads the risk picture for a system and accepts it, in writing, before it carries production data.
What makes it a process is that it repeats. New systems, major changes, and expiring approvals all go through it.
Evidence to collect
- The authorization procedure and the role assignments.
- Signed approval records for key systems, with date and conditions.
- The risk summary the approver saw.
- A schedule or trigger for re authorization.
- Link from authorization decisions to your risk register and monitoring.
Common gaps
- Approvals given verbally with no record.
- The approver is the same person who built the system.
- An approval that never expires.
- Monitoring results that never reach the approver.
How to implement it
Define who can accept risk, and for what scale. Create a one page approval form that lists risks, open findings, and conditions. Set a review date and connect it to continuous monitoring output.
Try it yourself
The demo walks through a risk register, the record an approver reads before signing.
Click through it at your own pace, or open it full screen.
Quick check
Do we need an authority to operate?
That term belongs to federal practice. The control's idea, a named approver accepting documented risk, applies anywhere.
