Instructor: In this lesson, 2 2
we're going to talk about Step 6 in the Real World. 3 3
Now, step six is the authorized step, 4 4
and the purpose of the authorized step 5 5
is to provide accountability by requiring a senior official 6 6
to determine if the security and privacy risk 7 7
based on the operation of a system 8 8
or the use of common controls is acceptable. 9 9
At the end of step six, we want to achieve four main outcomes. 10 10
First, we want to ensure an authorization package, 11 11
including the executive summary, system security 12 12
and privacy plan, assessment reports 13 13
and the plan of action of milestones has been created. 14 14
Second, we want to ensure a risk determination 15 15
has been rendered. 16 16
Third, we want to ensure 17 17
that risk responses have been provided. 18 18
And fourth, we want to ensure that the authorization 19 19
for the system or common controls have been approved 20 20
or denied at the end of this authorized step. 21 21
All right, let's take a look 22 22
at what step six looks like in the real world. 23 23
Now, when it comes to step six, 24 24
which is the authorized step, 25 25
it can get a little tricky in the real world 26 26
because sometimes you may have a hard time figuring out 27 27
exactly who is the senior official 28 28
who will be responsible for making that risk decision. 29 29
If you took the time back in the preparation stage 30 30
to figure that out, this is going to go a lot smoother for you. 31 31
But if not, it may be sitting in somebody's queue 32 32
in this digital system 33 33
waiting for them to look at your package. 34 34
And if you don't even know who's supposed to be 35 35
on the hook for doing that, 36 36
it can actually slow down the entire process 37 37
and the decision you're hoping to receive. 38 38
So in step number six 39 39
of the risk management framework process, 40 40
we're going to try to go ahead and get authorization 41 41
to operate the system which is known as an ATO. 42 42
This is where your senior official 43 43
is going to make their risk decision 44 44
based on whether or not they want to authorize your system 45 45
to be able to actually operate in the real world. 46 46
For example, if I was still working 47 47
in a military environment, 48 48
I might have a brand new system that we decided 49 49
what kind of controls we were going to use for it 50 50
and we've implemented those controls. 51 51
Then we assess those controls, 52 52
and now we're going to go over to a senior decision maker 53 53
and ask them 54 54
can I connect this new system to this top secret network? 55 55
And they're going to look at all the data 56 56
and all the mitigations and controls we put in place 57 57
and determine do they accept what residual risk is there 58 58
and allow me to connect that system. 59 59
Because when we talk about a system, 60 60
there's always going to be some level of risk there. 61 61
The question is, is this an acceptable level 62 62
that is low enough that we can accept the residual risk 63 63
or do we need to go back and lower that risk again? 64 64
To do that, that may involve adding additional controls. 65 65
Or maybe our authorizing official said, 66 66
"I don't like the fact 67 67
that you categorize that system as a low. 68 68
I think it should be a medium 69 69
and therefore it needs additional controls." 70 70
In which case, you're going to go back into step two, 71 71
recategorize the system, then go to step three, 72 72
select additional controls, go into step four, 73 73
implement those controls, go into step five, 74 74
bring that assessor back in to make sure those controls 75 75
have been implemented properly and then you can ask again 76 76
for that risk decision here in the authorized step. 77 77
So sometimes, these things aren't linear 78 78
and we do have to circle back 79 79
and start earlier again in the process 80 80
if we didn't get approval as we went along 81 81
with all of our different things we did, 82 82
such as categorization, selection, 83 83
implementation, assessment 84 84
and now here in the authorized step. 85 85
Now, when it comes to authorization, 86 86
sometimes you are going to have difficulty figuring out 87 87
who is going to be the authority for that package. 88 88
Now in general, you do want to figure this out 89 89
back in step one with the preparation step, 90 90
but sometimes the operating environment changes 91 91
while you're working on an RMF package. 92 92
For example, about 10 years ago, 93 93
I was working with the Navy and the Navy created 94 94
a new command called Fleet Cyber Command. 95 95
Now, Fleet Cyber Command was now going to be 96 96
the organization in charge of authorization 97 97
for all packages no matter where it was going to operate 98 98
in the world. 99 99
As long as it was operating on a Navy network 100 100
or a Navy system, it would have to go back 101 101
to Fleet Cyber Command for their approval. 102 102
Now, a lot of the other commanders 103 103
in different areas of the world, such as the Pacific region 104 104
or the Africa region or the Europe region thought, 105 105
"Hey, that doesn't seem right to me. 106 106
I used to be the authorizing official 107 107
for all the computer networks in my region of the world. 108 108
I should still be able to do that 109 109
because it's operating on my network 110 110
in my geographical region." 111 111
And so, there were a lot of fights that were happening 112 112
between different admirals and staffs 113 113
trying to determine who was going to be 114 114
the authorizing official and why were the people 115 115
who used to be the authorizing official 116 116
no longer able to be the authorizing official anymore 117 117
because it was all being recentralized 118 118
back at Fleet Cyber Command. 119 119
So when that change happened, there was actually packages 120 120
that were going through the RMF process, 121 121
and when they started in step one, 122 122
they thought that the regional commander 123 123
was going to be their authorizing official, 124 124
so they built out the system based on that risk level 125 125
and that risk tolerance that those commanders had. 126 126
But by the time the package got to step six 127 127
for the authorization, 128 128
it was now a different authorizing official 129 129
and this meant there was a lot of differences 130 130
between what was delivered as the RMF package 131 131
to one commander's level 132 132
instead of the current commander's level 133 133
and this additionally caused problems 134 134
where a lot of packages got held up because of this. 135 135
Now, luckily, over the last five to 10 years, 136 136
a lot of that has gotten sorted out 137 137
and people now understand 138 138
which is the right authorizing person. 139 139
But as everything in the government, 140 140
what's old becomes new again 141 141
and changes happen all the time. 142 142
So if there's a big organizational shift 143 143
in your company or your organization, 144 144
you may have an authorizing official 145 145
who you thought was going to review your package 146 146
who is no longer going to be that person 147 147
and this can cause issues for you. 148 148
So like I said, I saw this issue happen 149 149
with operational commanders 150 150
having the issue with Fleet Cyber Command 151 151
being the authorizing official. 152 152
The operational commanders thought 153 153
they should still be able to approve it 154 154
because it's the things they wanted done. 155 155
And if they wanted something done, such as a new system, 156 156
they didn't want to have to wait 157 157
for somebody on the other side of the world 158 158
to approve it for them. 159 159
And so you could see that there was this difference 160 160
between who wanted to be the authorizing official 161 161
and who was dictated as the authorizing official 162 162
and this can lead to a lot of delays in the process. 163 163
Now overall, if you do a good job in your preparation phase, 164 164
you'll be able to identify these pain points early on 165 165
and be able to find ways to get around these blockages 166 166
and be able to get things going again. 167 167
Now, the biggest thing that I find 168 168
that's the issue these days 169 169
when it comes to the authorization step, 170 170
is actually finding somebody who has time 171 171
to go through that package and then say yes or no to it. 172 172
In the case of the Navy, they were using Fleet Cyber Command 173 173
as their single authorization authority 174 174
and the person who is in charge of Fleet Cyber Command 175 175
is a three-star admiral. 176 176
Now, unfortunately, this three-star admiral 177 177
is a really busy person, and so they don't have time 178 178
to read through two or three or 400 pages of documentation 179 179
every time somebody wants something approved inside of RMF. 180 180
So they delegated it down from the admiral level 181 181
into a senior officer level. 182 182
Generally, this was somebody as a civilian 183 183
who was a GS-13, 14, or 15, 184 184
or an officer as an 04, 05 or 06 185 185
inside of Fleet Cyber Command. 186 186
And so, instead of having a single authority 187 187
which was the admiral, 188 188
that was now delegated down to this team 189 189
of authorizing officials which had about five to 10 people. 190 190
Now, that means for everybody in the Navy worldwide, 191 191
which is millions of end users, 192 192
anything that need to be approved 193 193
had to go through these five to 10 people. 194 194
And that's what I mean by the fact 195 195
that it's important to understand 196 196
who is going to be the one making this authorization decision 197 197
because everybody has a different risk tolerance 198 198
and everybody has a different way 199 199
that they like to see their packages. 200 200
Now, in addition to the fact that different people 201 201
like to look at packages a different way, 202 202
there's also the issue 203 203
of some people are just busier than others. 204 204
So as I said, there may have been five or 10 people 205 205
who are authorized to look at and approve these RMF packages 206 206
but those five to 10 people 207 207
didn't all operate at the same speed or in the same ways. 208 208
So you may be assigned person number one 209 209
and person number one might tell you, "Yes, 210 210
I've got time to go through your 300-page RMF package, 211 211
I'll be happy to go ahead and get that done for you." 212 212
And you think it's going to take maybe a couple of days. 213 213
Well, a week or two goes by and it's still not back. 214 214
Another week or two goes by and it's still not back. 215 215
At this point, it's been a month. 216 216
Maybe we're getting into month number two 217 217
and it still hasn't come back yet. 218 218
So you reach out to that authorizing official and say, 219 219
"What's going on?" 220 220
And they say, "Oh, yeah, yeah 221 221
I just didn't have time for it. 222 222
It's in my pile. 223 223
I'll get to it, I'll get to it, I'll get to it." 224 224
Well, the problem with that is 225 225
it's still sitting in their pile. 226 226
And so, if it's stuck in that person's pile 227 227
and new ones are coming in all the time, 228 228
you may be getting buried towards the bottom of that pile. 229 229
So again, this is where your soft skills can come and help 230 230
where you can work with that person to get your package 231 231
back up to the top of their priorities 232 232
so they can hopefully, get through it 233 233
and get you an answer in a timely manner. 234 234
Now also, when you're going through this authorized step, 235 235
it's important to understand what you're trying to achieve 236 236
as the result of this authorized step. 237 237
You are looking to get one of three possible outcomes. 238 238
The first outcome is that your package 239 239
can be accepted the way it is and you get a full ATO, 240 240
which is an authorization to operate. 241 241
This ATO is valid for three years on average 242 242
and allows you to be able to go and connect your system 243 243
to the network and start using it. 244 244
The second thing you can get is a straight up denial. 245 245
Basically, they'll say, "There's too much risk. 246 246
I am not having it. 247 247
No, you cannot connect this." 248 248
And in that case, you need to ask them 249 249
what things would I need to do? 250 250
What is the level of risk that you want? 251 251
And that way you can go back and recategorize, 252 252
reselect and re-implement those controls 253 253
to get that risk down to an acceptable level. 254 254
And the third thing you might get is 255 255
what's called an interim authority to operate or an IATO. 256 256
Now, an IATO is basically a mini ATO. 257 257
With the IATO, we call this an interim ATO 258 258
because it's only valid for one year or 12 months. 259 259
Essentially with an IATO, 260 260
you're able to connect your system to the network 261 261
for the next 12 months. 262 262
And during that time, 263 263
you can work on mitigating that risk down to a lower level. 264 264
For example, let's say the authorizing official 265 265
looked at all of your documentation and they said, 266 266
"You know what? 267 267
This system is pretty risky. 268 268
It's not so risky that I'm going to deny you 269 269
but I'm not going to give you a full authorization 270 270
to operate where I'm not going to look at this package again 271 271
for another three years. 272 272
So in this case, here are the things I want you to do 273 273
to get this risk level down in the next 12 months." 274 274
So during that next 12 months, 275 275
you're able to connect the system, 276 276
you can continue to implement your controls, 277 277
you can continue to assess your controls 278 278
and show what you're going to do to get that level of risk 279 279
down to an acceptable level. 280 280
Once you do, that IATO or interim authority to operate 281 281
can then transition into a full authority to operate 282 282
or ATO that gives you the full 36 month 283 283
or three-year refresh cycle. 284 284
So at this point, you'll now have POA&M 285 285
or a Plan of Action and Milestones 286 286
that you can then implement 287 287
based on those new controls you've been selecting 288 288
to bring that risk down to an acceptable level 289 289
and it'll move you from an IATO into an ATO 290 290
if you've been able to mitigate that risk 291 291
down to an acceptable level 292 292
that works with the authorization step for you. 293 293
(dramatic music)