Assessment, Authorization, and Monitoring Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for assessment, authorization, and monitoring in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers security assessment and authorization. Authorization is the risk-based decision by which a senior official accepts residual risk on behalf of the agency and its mission, and that official is accountable for it. The Organization must run continuous authorization consistent with NIST SP 800-37 and OMB A-130. That means independent assessments, plan of action and milestones (POA&M) management with enforced remediation timelines, and continuous monitoring that informs the authorization decision. The Organization must escalate when risk exceeds tolerance. High Value Assets must receive independent assessment under OMB M-19-03, and the Organization must remediate critical and high findings within 30 days.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• GV.OV — Oversight (Govern function)
• ID.IM — Improvements (Identify function)
• DE.CM — Continuous Monitoring (Detect function)

These categories fall under the Detect, Govern, Identify function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every assessment, authorization, and monitoring control in the low baseline of FIPS 200 and NIST SP 800-53B:

• CA-01 — Policy and Procedures
• CA-02 — Control Assessments
• CA-02(1) — Independent Assessors
• CA-03 — Information Exchange
• CA-05 — Plan of Action and Milestones
• CA-06 — Authorization
• CA-07 — Continuous Monitoring
• CA-07(4) — Risk Monitoring
• CA-08 — Penetration Testing
• CA-09 — Internal System Connections

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the CA control family. They add to the NIST SP 800-53 control requirements in the Policy section.

OMB M-25-04: FY 2025 FISMA Guidance

• The organization must implement continuous monitoring programs that provide real-time visibility into security control effectiveness, replacing point-in-time assessments with ongoing assessment and authorization. Deadline: FY 2025. (OMB M-25-04, §3)

NIST SP 800-37: Risk Management Framework

• The organization must apply the seven steps of the Risk Management Framework (Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor) and their tasks to every system and every set of common controls throughout its life cycle. Authorization must be based on risk management decisions, not compliance checklists. (NIST SP 800-37r2, Ch. 2 and Ch. 3)
• The organization must ensure continuous monitoring tracks security control effectiveness on an ongoing basis, with results feeding back into the risk management process. Authorizations must be renewed based on monitoring data, not on a fixed schedule. (NIST SP 800-37r2, §4)

OMB M-19-03: Strengthening Cybersecurity through the High Value Asset Program

• The organization must ensure independent security assessments of designated High Value Assets are conducted (by CISA, agency independent assessors, or approved third parties) using the HVA assessment methodology, and track resulting findings through formal remediation plans. (OMB M-19-03, §C)
• The organization must remediate critical and high-severity weaknesses identified during HVA assessments within 30 days of the final report, or document a remediation plan with milestones when full remediation is not achievable in that window. Deadline: 30 days from final HVA report. (OMB M-19-03, §C.3)

FedRAMP CR26: FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators)

• The organization must complete the authorization process for each system that uses a FedRAMP authorized cloud service before the service handles federal information. (FedRAMP Consolidated Rules for 2026, AGU-USE-ABU)
• The organization must review each Ongoing Certification Report from a FedRAMP authorized provider for changes that affect the risk the Authorizing Official accepted. (FedRAMP Consolidated Rules for 2026, CCM-AGM-ROR)
• The organization must notify FedRAMP when a provider’s ongoing reports, Quarterly Review, or other certification data are likely to lead the Authorizing Official to withdraw the authorization. (FedRAMP Consolidated Rules for 2026, AGU-USE-NFC)
• The organization should limit the authorized use of a Class A certified cloud service to 12 months unless the provider is seeking a Class B, C, or D certification. (FedRAMP Consolidated Rules for 2026, AGU-USE-CLA)

OMB Circular A-130: Managing Information as a Strategic Resource

• The organization must have the SAOP review and approve each system’s privacy plan before authorization, reauthorization, or ongoing authorization, and review the authorization package of each system that handles PII before the Authorizing Official decides. (OMB Circular A-130, Appendix I §4(e)(8)-(9))
• The organization must move a system or its common controls to ongoing authorization only when it is eligible and its Authorizing Official formally approves the move. (OMB Circular A-130, Appendix I)
• The organization must define and use a process to designate the systems and common controls that meet the conditions for ongoing authorization. (OMB Circular A-130, Appendix I)

44 U.S.C. §§ 3607-3616: FedRAMP Authorization Act

• The organization must treat the security assessment and authorization package of a FedRAMP-authorized cloud service as presumed adequate, and add only the review the Organization’s own use requires. (44 U.S.C. § 3613(e))
• The organization must send the FedRAMP office a copy of each authorization to operate the Organization issues for a cloud product or service. (44 U.S.C. § 3613)

OMB M-24-15: Modernizing the Federal Risk and Authorization Management Program (FedRAMP)

• The organization must authorize use of a FedRAMP-authorized cloud service by reviewing its FedRAMP package and the Organization’s customer responsibilities, not by repeating the provider’s assessment. (OMB M-24-15, §IV)

OMB M-02-01: Guidance for Preparing and Submitting Security Plans of Action and Milestones

• The organization must never change the original scheduled completion date of a plan of action and milestones item; record any delay as a milestone change. (OMB M-02-01, Attachment)
• The organization must record for each plan of action and milestones item the weakness, owner, resources needed, milestones, and the review that found it. (OMB M-02-01, Attachment)

NIST SP 800-47 Rev 1: Managing the Security of Information Exchanges

• The organization should document each information exchange with an external organization in an agreement, such as an interconnection security agreement, before the exchange starts. (NIST SP 800-47 Rev 1, §2)
• The organization should manage each information exchange through planning, establishment, maintenance, and discontinuation, and update or end the agreement when the exchange changes or stops. (NIST SP 800-47 Rev 1, §§3-5)

NIST SP 800-115: Technical Guide to Information Security Testing and Assessment

• The organization should plan each penetration test with written rules of engagement, approved before testing starts, that set the scope, methods, timing, and contacts. (NIST SP 800-115, §6 and Appendix B)
• The organization should conduct penetration tests in four phases: planning, discovery, attack, and reporting. (NIST SP 800-115, §5.2)

3. Policy #

The Organization must implement and maintain its assessment, authorization, and monitoring controls to meet the following requirements:

CA-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: GV.OV (Oversight)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] assessment, authorization, and monitoring policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and
3. Review and update the current assessment, authorization, and monitoring:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep an organization-level assessment, authorization, and monitoring policy and the procedures that put it into practice. The CISO is the designated official who manages the development, documentation, and distribution of both documents. The CISO distributes them to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and the stakeholders who work under them. The CISO must review and update each document at least every 3 years, and sooner after a major change to applicable policy. The policy must describe how the program operates. The program applies the Risk Management Framework in NIST SP 800-37 across each system’s lifecycle. It also follows OMB M-25-04, which directs a move toward ongoing authorization based on continuous monitoring instead of point-in-time assessment. The policy must state plainly that authorization decisions rest on risk judgment, not on a completed checklist.

CA-02 — Control Assessments #

Baselines: Low / Moderate / High / Privacy CSF 2.0: GV.OV (Oversight), ID.IM (Improvements), DE.CM (Continuous Monitoring)

Requirement:

1. Select the appropriate assessor or assessment team for the type of assessment to be conducted;
2. Develop a control assessment plan that describes the scope of the assessment including:

1. Controls and control enhancements under assessment;
2. Assessment procedures to be used to determine control effectiveness; and
3. Assessment environment, assessment team, and assessment roles and responsibilities;

3. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
4. Assess the controls in the system and its environment of operation at least annually to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
5. Produce a control assessment report that document the results of the assessment; and
6. Provide the results of the control assessment to individuals or roles to include FedRAMP PMO.

Implementation guidance:

The ISSO must arrange an assessment of the controls in each system at least every year. The ISSO must also arrange one sooner when a significant change affects the system’s boundary, its architecture, or the types of information it handles. Each assessment must follow a written plan that names the controls, procedures, environment, and team roles. Each yearly assessment must include every control whose POA&M item closed since the last assessment. It must also include every control tied to an audit finding or a security incident in that period, in addition to the controls the monitoring rotation schedules. For a new system or a major change, security engineering staff who are independent of the System Owner must review the security and privacy architecture first. The Authorizing Official or a designated representative must approve the plan only after that review is on file, and before any testing starts. The Organization must select assessors who match the assessment type and hold the skills the system’s technology requires. The assessment team must send its report to at least the Authorizing Official, the System Owner, and the ISSO. The ISSO must enter every weakness in the POA&M with an owner. Under OMB M-25-04, continuous monitoring also supplies assessment evidence.

CA-02(1) — Independent Assessors #

Baselines: Low / Moderate / High

Requirement:

Employ independent assessors or assessment teams to conduct control assessments.

Implementation guidance:

Assessors or assessment teams must be independent of the development, operation, and management of the system they assess, and they must hold no interest in the outcome. The Authorizing Official must decide the level of independence each assessment requires, based on the system’s category and the risk the authorization decision carries. The Authorizing Official must reject results whose independence cannot support a credible authorization decision. For designated High Value Assets, OMB M-19-03 requires an independent assessment by the Cybersecurity and Infrastructure Security Agency (CISA), agency independent assessors, or approved third parties.

CA-03 — Information Exchange #

Baselines: Low / Moderate / High / High Value Asset (HVA) overlay

Requirement:

1. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [organization-defined] — to be defined];
2. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and
3. Review and update the agreements at least annually and on input from AO.

Implementation guidance:

The Organization must approve and manage every information exchange between its systems and other systems through a written agreement. The ISSO must choose the agreement type under NIST SP 800-47 Rev 1. A system interconnection needs an interconnection security agreement and a memorandum of understanding or agreement. Any other exchange with an outside party, such as an application programming interface or a file transfer, needs an information exchange agreement and a memorandum of understanding or agreement. Each agreement must record how the interface works, the controls and duties on each side, and the impact level of the information. Each agreement must also state when either party may suspend the exchange and how either party may end it. The ISSO must review each agreement at least every year and after a significant change on either side. The ISSO must reissue each agreement when the system is reauthorized. The Authorizing Official owns the risk decision for each exchange. The Organization must suspend any exchange that operates without a current agreement. The Interconnection and Information Exchange Agreement Templates (TMPL-ISA-001) give the agreement forms and the steps for each phase.

CA-05 — Plan of Action and Milestones #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: GV.OV (Oversight)

Requirement:

1. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
2. Update existing plan of action and milestones at least monthly based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

Implementation guidance:

The ISSO must enter every weakness found by a control assessment, an audit, or continuous monitoring in the system’s plan of action and milestones (POA&M). Each entry must follow the format in OMB M-02-01. It must name an owner, the root cause, the planned corrective actions, the milestones, and the scheduled completion date. It must also give the estimated cost and the budget investment that pays for the fix. System Owners own the POA&M for their systems. ISSOs must update it at least every month. Once set, the scheduled completion date must not change. The ISSO must record each slip as a milestone change with its reason. For High Value Assets, the System Owner must remediate critical and high weaknesses within 30 days of the final assessment report, as OMB M-19-03 requires. If the System Owner cannot meet that window, the entry must hold a remediation plan with milestones. The ISSO must close an item from an Inspector General or other external audit only after the auditor agrees that the weakness is fixed. When the System Owner cannot correct a weakness, the Authorizing Official must accept the remaining risk in writing.

CA-06 — Authorization #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: GV.OV (Oversight)

Requirement:

1. Assign a senior official as the authorizing official for the system;
2. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;
3. Ensure that the authorizing official for the system, before commencing operations:

1. Accepts the use of common controls inherited by the system; and
2. Authorizes the system to operate;

4. Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
5. Update the authorizations in accordance with OMB A-130 requirements or when a significant change occurs.

Implementation guidance:

The Organization must assign a senior official as the Authorizing Official for each system and for the common controls that systems inherit. Before a system enters operation, its Authorizing Official must accept the common controls it inherits and must authorize the system. The Authorizing Official must issue one of the decisions in NIST SP 800-37 Rev 2: authorization to operate, common control authorization, authorization to use, or denial. Each condition on an authorization must have a POA&M item and a deadline. A cloud service within the scope of FedRAMP must hold a FedRAMP authorization before it handles federal information, as OMB M-24-15 requires. The Authorizing Official must update each authorization under OMB A-130 requirements or when a significant change occurs and after a significant change to the system. Under OMB M-25-04, the goal is ongoing authorization based on continuous monitoring, with the required limit as a backstop. The Authorization Decisions and Approaches section of the Assessment, Authorization, and Monitoring procedure sets out the full process.

CA-07 — Continuous Monitoring #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: GV.OV (Oversight), ID.IM (Improvements), DE.CM (Continuous Monitoring)

Requirement:

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a. Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics — to be defined]; b. Establishing [Assignment: organization-defined frequencies — to be defined] for monitoring and [Assignment: organization-defined frequencies — to be defined] for assessment of control effectiveness; c. Ongoing control assessments in accordance with the continuous monitoring strategy; d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; e. Correlation and analysis of information generated by control assessments and monitoring; f. Response actions to address results of the analysis of control assessment and monitoring information; and g. Reporting the security and privacy status of the system to include AO [Assignment: organization-defined frequency — to be defined].

Implementation guidance:

Every system must operate under a system-level continuous monitoring strategy that is consistent with the organization-level strategy. System Owners must build the strategy around the metrics and monitoring frequencies in the Organization’s Continuous Monitoring Plan. ISSOs must carry it out. The ISSO must send a security status report to the Authorizing Official, the CISO, and the Privacy Officer at least [CA-07 parameter 7 — to be defined], and at once when the security posture changes. The report must give the assessment results, the risks carried forward, open vulnerabilities by severity, and POA&M progress with late items. It must also list the risks proposed for acceptance and say whether the trend is improving or getting worse. The Authorizing Official must sign each report to accept the residual risk it states. Under OMB M-25-04, these results drive the risk response and the reauthorization decision.

CA-07(4) — Risk Monitoring #

Baselines: Low / Moderate / High / Privacy

Requirement:

Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring.

Implementation guidance:

The continuous monitoring strategy must include risk monitoring measured against the Organization’s risk tolerance. The ISSO must use risk monitoring to confirm that each completed risk response reduced the risk it addressed. The ISSO must also verify that the required measures are in place and the requirements are met, and detect changes in systems or their environments that change the risk picture. The CISO must ensure that risk monitoring results reach the same decision-makers who receive control status. A risk that was tolerable last year may not be tolerable now.

CA-08 — Penetration Testing #

Baselines: Low / Moderate / High CSF 2.0: GV.OV (Oversight), ID.IM (Improvements), DE.CM (Continuous Monitoring)

Requirement:

Conduct penetration testing at least annually on [Assignment: organization-defined system(s) or system components — to be defined].

Implementation guidance:

The Organization must run a penetration test at least every year against, at a minimum, FIPS-199 High, Mission Essential, High Value Asset, and Financial Systems. Each internet-facing system and each high-impact system must also receive a penetration test before its initial authorization. Testers must follow the planning, discovery, attack, and reporting phases in NIST SP 800-115. Every test must run under rules of engagement that both sides sign before testing starts. The rules must cover scope, constraints, safety measures, and the handling of any protected information the test exposes. Testers must not change or delete logs and must not leave persistent access. Testers who find signs of a real compromise must stop and report it to the ISSO and the Security Operations Center at once. Any test or scan by an outside party requires the Authorizing Official’s approval. The ISSO must turn each finding into a POA&M entry and verify each fix by a retest.

CA-09 — Internal System Connections #

Baselines: Low / Moderate / High / HVA overlay

Requirement:

1. Authorize internal connections of [Assignment: organization-defined system components — to be defined] to the system;
2. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;
3. Terminate internal system connections after [Assignment: organization-defined conditions — to be defined]; and
4. Review [Assignment: organization-defined frequency — to be defined] the continued need for each internal connection.

Implementation guidance:

System Owners must authorize each internal connection of a component to a system before it connects. Components include mobile devices, notebooks and desktops, printers, copiers, scanners, servers, and networking components. A System Owner may authorize components individually or as a class of components that share common characteristics and configurations. Each authorization must document how the interface works, the security and privacy requirements it must meet, and the type of information that crosses it. The Organization must disconnect a component after a component failure, a security incident, or a system failure, or when the CISO directs it. System Owners must review the continued need for every internal connection at least [CA-09 parameter 3 — to be defined] and must remove any connection that no one can justify.

Risk Management Framework #

The Organization must manage the security and privacy risk of every system with the seven steps of the NIST Risk Management Framework (RMF) in NIST SP 800-37 Rev. 2. The steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. They apply to new systems, to systems already in operation, and to common controls. The Assessment, Authorization, and Monitoring procedure lists each step’s tasks, the person who does each one, and the record it produces.

The table below names, for each RMF step, what must happen, who is accountable, and who must approve before the next step starts.

• The agency head must assign the risk management roles in NIST SP 800-37 Rev. 2 and approve the risk management strategy before any system is authorized under it.
• No one may start an RMF step for a system until the approval the table above names for the step before it is recorded in the governance, risk, and compliance (GRC) system.
• The CISO may skip an RMF task that NIST SP 800-37 marks optional, and must record each decision to skip one.
• The AO must not delegate the authorization decision. An Authorizing Official Designated Representative may do the other AO tasks.
• The Authorization Decisions section of this policy sets the types of decision and the authorization approaches the AO may use. The types are authorization to operate, common control authorization, authorization to use, and denial. The approaches include type and facility authorization. The same section sets when the AO may move a system to ongoing authorization.

The AO must follow these rules for the end date of an authorization:

• Each authorization to operate and each common control authorization must state a termination date, unless the system or the common controls are under ongoing authorization.
• The AO may shorten a termination date at any time when the security or privacy posture gets worse.
• An authorization under ongoing authorization must state how often the AO reviews the risk instead of a termination date.
• If the continuous monitoring program cannot support ongoing authorization, the AO must set a maximum authorization period.
• An authorization to use needs no termination date. It stays in effect while the AO accepts the risk and the provider’s authorization stays current.
• When the AO lets a system run in production for testing, the AO must limit the authorization to the time the testing needs.
• No system may operate after its termination date without a new signed decision.

The System Owner must tell the AO when any of these events occurs. The AO must then decide whether to reassess or reauthorize the system:

• new threat, vulnerability, privacy risk, or impact information;
• more findings or weaknesses from continuous monitoring than the strategy allows;
• a new mission or business requirement;
• a new AO for the system;
• a significant change in the risk assessment findings;
• a significant change to the system, its common controls, or its environment, as the Configuration Management policy defines it;
• a change in the supply chain that affects security or privacy risk;
• a breach, an incident, or a failure of the continuous monitoring program;
• a measure that passes an organization-defined threshold.

For each system that processes PII, the SAOP must:

• take part in assigning the RMF roles and in setting the risk management strategy;
• identify the common privacy controls and approve the Privacy Continuous Monitoring Strategy;
• review the information life cycle and decide which privacy compliance documents the system needs;
• review and approve the security categorization with the AO;
• review the privacy parts of the SSPP before the AO approves it;
• assess the privacy controls or name who assesses them;
• approve the privacy plan and the privacy assessment before the AO decides, and agree in writing to the privacy risk the decision accepts;
• receive the system’s privacy status reports and take part in each reauthorization decision.

Source: NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations (December 2018), Chapter 3 and Appendix F.

Authorization Decisions #

Only the Authorizing Official may decide whether the Organization may use a system, a set of common controls, or a service that another official authorized. No one may load production data on a system, or connect it to a production system, before the Authorizing Official signs a decision.

• The Authorizing Official must issue one of these written decisions: authorization to operate, authorization to operate with conditions, common control authorization, authorization to use, or denial of authorization.
• The Authorizing Official must tie each condition to a plan of action and milestones (POA&M) item with a deadline.
• For each significant change, the Authorizing Official must decide before production whether to reassess or reauthorize the system. The list of significant changes and the security impact analysis steps are in the Configuration Management policy and procedure.
• The Authorizing Official may use the traditional, joint, type, facility, and leveraged approaches in NIST SP 800-37 Rev. 2. Co-Authorizing Officials in a joint authorization must record how they share responsibility.
• The Authorizing Official may move a system to ongoing authorization only when it has a current authorization. The System Owner must also monitor all its controls under an approved continuous monitoring strategy.
• For a FedRAMP authorized cloud service, the Authorizing Official must follow the rules under Using FedRAMP and FedRAMP 20x Authorized Cloud Services in this policy.
• The Common Control Provider must have common controls assessed, authorized, and monitored. The provider must report their status to the Authorizing Official of each system that inherits them.
• For a system that processes PII, the Senior Agency Official for Privacy (SAOP) must approve the privacy plan and the privacy control assessment before the Authorizing Official decides.
• The SAOP must also agree in writing to the privacy risk the decision accepts.

Source: NIST SP 800-37 Rev. 2, Appendix F (authorization decisions, approaches, and ongoing authorization); OMB Circular A-130, Appendix I; FedRAMP Authorization Act (44 U.S.C. 3607-3616); OMB M-24-15, Modernizing the Federal Risk and Authorization Management Program (2024).

Using FedRAMP and FedRAMP 20x Authorized Cloud Services #

These rules apply to each cloud service the Organization uses under a FedRAMP authorization, on the Rev5 path or the FedRAMP 20x path. FedRAMP now calls its approval a FedRAMP Certification and rates it Class A, B, C, or D. The Organization’s own approval is still an authorization. The steps are in the Assessment, Authorization, and Monitoring procedure.

• Each cloud service within the scope of FedRAMP must hold a FedRAMP authorization before it creates, collects, processes, stores, or maintains federal information.
• The ISSO must review a service that OMB M-24-15 places outside FedRAMP scope, and that keeps no Organization information, under “Reviewing External Services” in the System and Services Acquisition policy and procedures. That review includes an information provider that only briefly processes non-sensitive information under a no-retention setting.
• The Authorizing Official must authorize each system that uses a FedRAMP authorized cloud service before anyone puts federal information in the service.
• The Authorizing Official must treat the provider’s FedRAMP package as presumed adequate and reuse it. The Security Control Assessor must not repeat the provider’s assessment.
• The Authorizing Official may rely on a Rev5 package or a FedRAMP 20x package. No one may require a provider to use a particular FedRAMP path unless the agency head or a delegate documents the need.
• The Authorizing Official must not approve a Class A service for more than 12 months unless the provider is seeking a Class B, C, or D certification.
• The System Owner must record in the SSPP the controls the system inherits from the service and the customer responsibilities the Organization carries.
• For a FedRAMP 20x service, the System Owner must also record which Key Security Indicator (KSI) measures depend on the Organization’s own settings.
• The System Owner must configure each service under the provider’s Secure Configuration Guide.
• The ISSO must review each ongoing report, vulnerability report, and significant change notice the provider sends. The ISSO must tell the Authorizing Official about each change in risk.
• The ISSO must send FedRAMP a copy of each signed authorization for a cloud service.
• The CISO must notify FedRAMP and the provider when provider information is likely to lead the Authorizing Official to withdraw the authorization.
• No one may ask a provider for security information or requirements beyond FedRAMP’s rules unless the agency head or a delegate documents the need. The CISO must then notify FedRAMP.
• The Contracting Officer must not agree to a contract term that stops the provider from following FedRAMP rules.

Each role does this work:

• Authorizing Official: decides whether the system may use the service, sets conditions, and decides what each significant change means for the authorization.
• CISO: names the official who reviews provider reports and attends Quarterly Reviews, and sends the Organization’s notices to FedRAMP.
• ISSO: gets and stores the package, reviews the provider’s ongoing reports, and sends each signed authorization to FedRAMP.
• System Owner: confirms the service fits the system, configures it, and writes the Organization’s share of the controls in the SSPP.
• Contracting Officer and Contracting Officer’s Representative: put the required terms in the contract, check the deliverables, and collect federal data when use ends.

Source: FedRAMP Authorization Act (44 U.S.C. 3607-3616), including the presumption of adequacy in 44 U.S.C. 3613(e); OMB M-24-15, Modernizing the Federal Risk and Authorization Management Program (2024); FedRAMP Consolidated Rules for 2026, version 2026.10.13.01: Agency Use (AGU), Collaborative Continuous Monitoring (CCM), Vulnerability Evaluation and Reporting (VER), Significant Change Notification (SCN), Certification Data Sharing (CDS), and the Key Security Indicators; NIST SP 800-37 Rev. 2.

Related Required Processes #

• Each High Value Asset also receives the independent assessment and 30-day remediation the High Value Assets section of the Planning policy sets.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the POA&M process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of assessment, authorization, and monitoring controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves assessment, authorization, and monitoring through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Automate evidence collection for common controls so assessments consume live data rather than point-in-time artifacts.
6. Progress systems from time-based reauthorization toward ongoing authorization backed by continuous monitoring dashboards.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FedRAMP Authorization Act (44 U.S.C. §§ 3607-3616 (FY2023 NDAA, Pub. L. 117-263, § 5921)), December 23, 2022.
• FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators), June 24, 2026.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-47 Rev. 1: Managing the Security of Information Exchanges, July 2021.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-115: Technical Guide to Information Security Testing and Assessment, September 2008.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-02-01: Guidance for Preparing and Submitting Security Plans of Action and Milestones, October 17, 2001.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.
• OMB M-24-15: Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.