ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Under NIST SP 800-37 Rev. 2, the AO is the single official who determines whether the system's residual risk is acceptable and documents that decision in the authorization decision document (e.g., an ATO). As long as the weakness is recorded in the POA&M with an approved remediation plan and schedule, the RMF does not mandate additional signatures or compensating controls. Downgrading a system's impact level to avoid a required control would violate the RMF categorization process. Therefore, the only RMF-mandated step before issuing the ATO is to ensure the weakness and its remediation plan are documented in the POA&M that accompanies the authorization package.