PM-10
PM-10: Security Authorization Process
The organization:
- PM-10a.: Manages (i.e., documents, tracks, and reports) the security state of organizational information systems and the environments in which those systems operate through security authorization processes;
- PM-10b.: Designates individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
- PM-10c.: Fully integrates the security authorization processes into an organization-wide risk management program.
Supplemental
Security authorization processes for information systems and environments of operation require the implementation of an organization-wide risk management process, a Risk Management Framework, and associated security standards and guidelines. Specific roles within the risk management process include an organizational risk executive (function) and designated authorizing officials for each organizational information system and common control provider. Security authorization processes are integrated with organizational continuous monitoring processes to facilitate ongoing understanding and acceptance of risk to organizational operations and assets, individuals, other organizations, and the Nation.
| CIA Levels | |
|---|---|
| Confidentiality | low |
| Integrity | low |
| Availability | low |
| Overlays |
|---|
| Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI) |