ISC2 Governance, Risk and Compliance (CGRC) Practice Question

NIST SP 800-37 Rev. 2 states that an Authorization Decision document must contain three core elements: the authorization decision itself (e.g., ATO, ATO with conditions, or denial), the authorization termination date, and the terms and conditions under which the system is approved to operate. The terms and conditions section spells out any usage restrictions, mandatory security controls, reporting requirements, or other constraints that the authorizing official imposes to keep residual risk within the organization's risk tolerance. Including the System Security Plan's executive summary, a memorandum of understanding with external parties, or recent continuous monitoring reports may be useful supporting artifacts, but none of those items is mandated content for the Authorization to Operate. Only the explicit terms and conditions satisfy the requirement to document operational limitations in the ATO.