CCI-000271

Ensure the authorizing official for the system authorizes the system to operate before commencing operations.

Implementation Guidance

The organization being inspected/assessed will ensure that an authorization document (e.g. authorization to operate (ATO), interim authorization to operate (IATO)) has been issued by the authorizing official (AO) prior to placing the information system into an operational status.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the authorization document to ensure the information system is authorized prior to being placed into operational status.

Compelling Evidence

1.) Signed and dated SOP/TTP, which ensures the information system is authorized prior to being placed into operational status

The controls below (if any) were marked by NIST as being related to CCI-000271.