Passo Authorize do NIST RMF: o pacote de autorização para o responsável pela autorização (Authorizing Official), com a síntese do sistema e da sua categorização, os controlos e os resultados de avaliação, o plano de ação e marcos, o risco residual e a decisão de autorização, que o próprio responsável pela autorização documenta.
Conteúdo
1. Conteúdo do pacote
2. Sistema e categorização
3. Síntese dos controlos e da avaliação
4. Plano de ação e marcos (POA&M)
5. Risco residual
6. Decisão de autorização
O que indica
Residual risks to bring to the Authorizing Official — One risk per entry.
Authorizing Official (role)
System impact level (FIPS 199) — When the categorization is not selected as a source.
Controls and assessment results — When they are not selected as sources: the baseline, the controls in place, what the assessment found.
Plan of action and milestones — One row per entry, e.g. AC-2: dormant accounts found; IT manager; Automate the review; March 2028
Number of pages — Target length when the AI writes the document. If left empty: the usual length of this kind of document.
Language of the document — Applied when the AI writes the document.
Roles and owners — Who is responsible for which area. Owners in the result are taken from here; where no role covers an area, the owner is left for you to fill.
Additional context — Anything the service should take into account.
Title — As it will appear on the result.
Author — Shown as the author of the deliverable; never filled in by the AI.
Sections, in order — The template's sections are proposed, one per line in order: drag to reorder, rename, remove or add.
