CCI-000271

The organization ensures the authorizing official authorizes the information system for processing before commencing operations.

Implementation Guidance

The organization being inspected/assessed will ensure that an authorization document (e.g. authorization to operate (ATO), interim authorization to operate (IATO)) has been issued by the authorizing official (AO) prior to placing the information system into an operational status.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the authorization document to ensure the information system is authorized prior to being placed into operational status.

Compelling Evidence

1.) Signed and dated SOP/TTP, which ensures the information system is authorized prior to being placed into operational status

The controls below (if any) were marked by NIST as being related to CCI-000271.