Paso Authorize del NIST RMF: el paquete de autorización para el responsable de la autorización (Authorizing Official), con el resumen del sistema y de su categorización, los controles y los resultados de evaluación, el plan de acción e hitos, el riesgo residual y la decisión de autorización, que documenta el propio responsable de la autorización.
Contenido
1. Contenido del paquete
2. Sistema y categorización
3. Resumen de los controles y de la evaluación
4. Plan de acción e hitos (POA&M)
5. Riesgo residual
6. Decisión de autorización
Lo que usted aporta
Residual risks to bring to the Authorizing Official — One risk per entry.
Authorizing Official (role)
System impact level (FIPS 199) — When the categorization is not selected as a source.
Controls and assessment results — When they are not selected as sources: the baseline, the controls in place, what the assessment found.
Plan of action and milestones — One row per entry, e.g. AC-2: dormant accounts found; IT manager; Automate the review; March 2028
Number of pages — Target length when the AI writes the document. If left empty: the usual length of this kind of document.
Language of the document — Applied when the AI writes the document.
Roles and owners — Who is responsible for which area. Owners in the result are taken from here; where no role covers an area, the owner is left for you to fill.
Additional context — Anything the service should take into account.
Title — As it will appear on the result.
Author — Shown as the author of the deliverable; never filled in by the AI.
Sections, in order — The template's sections are proposed, one per line in order: drag to reorder, rename, remove or add.
