Study. uk . com
  1. Home
  2. All questions
  3. Question 2

CISSP study material · question 2 of 500

A federal agency wants to adopt a case-management application that a peer agency already runs under a current authorization to operate. The adopting agency will load its own records into the service and has no appetite for repeating the full assessment. Which authorisation decision fits this situation?

  1. An authorization to use, issued by the adopting agency's own authorizing official after reviewing the provider's package
  2. An authorization to operate, issued by the provider's authorizing official on behalf of both agencies
  3. A common control authorization, issued to the provider so the adopting agency can inherit the whole service
  4. An interim authorization to test, issued while the adopting agency assesses the provider's controls itself
Show the answer

Answer: A. An authorization to use, issued by the adopting agency's own authorizing official after reviewing the provider's package

Authorization to use is the reciprocity decision: the customer's authorizing official reviews the provider's package and accepts risk for its own data. Common control authorization covers inheritable controls only.

Source: NIST SP 800-37 Rev. 2 (NIST) — SP 800-37 Rev. 2 > Appendix F, Authorization Decisions (Authorization to Use)

Challenge yourself on this topic → Study as cards