PM-10 Authorization Process

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: CA-6, CA-7, PL-2

Control statement

• a. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;
• b. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
• c. Integrate the authorization processes into an organization-wide risk management program.

NIST discussion

Authorization processes for organizational systems and environments of operation require the implementation of an organization-wide risk management process and associated security and privacy standards and guidelines. Specific roles for risk management processes include a risk executive (function) and designated authorizing officials for each organizational system and common control provider. The authorization processes for the organization are integrated with continuous monitoring processes to facilitate ongoing understanding and acceptance of security and privacy risks to organizational operations, organizational assets, individuals, other organizations, and the Nation.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-10

Determine if:

• PM-10a.
  • PM-10a.[01] the security state of organizational systems and the environments in which those systems operate are managed through authorization processes;
  • PM-10a.[02] the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes;
• PM-10b. individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;
• PM-10c. the authorization processes are integrated into an organization-wide risk management program.

Examine: Information security program plan; privacy program plan; procedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process; assessment, authorization, and monitoring policy; assessment, authorization, and monitoring procedures; system authorization documentation; lists or other documentation about authorization process roles and responsibilities; risk assessment results relevant to the authorization process and the organization-wide risk management program; organizational risk management strategy; other relevant documents or records.

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for management of the authorization process; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for authorization; mechanisms supporting the authorization process.

Policy statement

• The Chief Information Security Officer shall manage the security and privacy state of organizational systems, and the environments they operate in, through an authorization process. (PM-10a)
• The Senior leader shall designate the individuals who fill the roles in the risk management process, including an authorizing official for each system. (PM-10b)
• The Chief Information Security Officer shall integrate the authorization process into the organization-wide risk management program. (PM-10c)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-10 makes authorization an organization-wide process rather than a one-off event for each system. You manage the security and privacy state of your systems and their environments through authorization (a). You designate the people who fill the risk management roles (b), and fold authorization into the organization-wide risk management program (c). PM-10 is in the SP 800-53B Privacy baseline.

NIST’s PM-10 discussion names the roles: a risk executive (function), and a designated authorizing official for each system and each common control provider. It also integrates authorization with continuous monitoring, so risk is understood and accepted on an ongoing basis. SP 800-37 Rev. 2 is that process. Task P-1 assigns the roles, and its discussion says authorizing officials cannot be the system owner or common control provider for what they authorize. Appendix F describes four authorization decisions: authorization to operate, common control authorization, authorization to use, and denial of authorization.

Common implementations. The Program Management policy has the senior leader designate the risk management roles, including an authorizing official for each system. The Chief Information Security Officer runs the authorization process and ties it to the risk management program. The roles table in section 3 of the Information Security Program Plan records the designations, and its section 7 names the authorization procedure.

A typical procedure follows the RMF steps and uses the same templates for every system:

• A system security plan
• An assessment plan and assessment report
• A plan of action and milestones
• A signed decision with its terms, conditions and termination date

After authorization, the Continuous Monitoring Strategy keeps authorizing officials informed, and its section 12 sets the rules for ongoing authorization and reauthorization. The system inventory records each system’s authorizing official and authorization status.

An authorizing official may delegate the day-to-day work to a designated representative. SP 800-37 Rev. 2, Appendix D, says the only activity that cannot be delegated is “the authorization decision and signing of the associated authorization decision document (i.e., the acceptance of risk).” Task R-3 says the authorizing official “is the only person who can accept risk,” so the process routes every risk acceptance to them.

Organization-defined parameters. PM-10 has none. The choices the PM-10 clause makes, typical values your organization may set differently:

Choice	Typical value
Who designates the risk management roles, including each authorizing official (b)	The senior leader
Where the designations are recorded	The program plan’s roles table (section 3), with each system’s authorizing official named in its security plan
Who runs the authorization process and ties it to the risk management program (a, c)	The Chief Information Security Officer

Evidence assessors ask for.

• The written designation of each authorizing official, and of the risk executive (function)
• The documented authorization process, and its link to the risk management strategy and continuous monitoring
• The list of systems and common controls with their authorizing official, decision and termination date
• A sample of authorization decision documents, each signed by the authorizing official
• Continuous monitoring reports sent to authorizing officials, and records of the decisions they led to

Inheritance. PM-10 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system is authorized through the process under CA-6.

Common findings.

• An authorizing official who is also the system owner, or who manages the team that runs the system.
• Systems in operation with no authorization, or with one past its termination date.
• Common controls that systems inherit but that were never authorized.
• Decisions signed by a designated representative rather than the authorizing official.
• Authorization decisions with no reference to the organization’s risk tolerance.

Enhancements. PM-10 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, Appendix I, section 4.d(1) to (4), requires agencies to designate senior federal officials to authorize systems and agency-designated common controls. They must complete an initial authorization before a system becomes operational, based on “explicit acceptance of” the risk, move eligible systems to ongoing authorization with the authorizing official’s approval, and reauthorize on a time- or event-driven basis. Section 5.f, in the discussion of major provisions, says “only Federal Government personnel may serve as an authorizing official.” It also gives the Senior Agency Official for Privacy responsibility for reviewing the authorization package of a system that processes personally identifiable information. Where the authorizing official and the Senior Agency Official for Privacy “cannot reach a final resolution,” the head of the agency “must review the associated risks and requirements and make a final determination regarding the issuance of the authorization to operate.” That settles a disagreement; it does not let anyone else accept risk in the normal course, so the process still routes every risk acceptance to the authorizing official.

Artifacts

• Information Security Program Plan
• Program Management Decision Worksheet
• Program Management Policy