Supplemental Guidance on Ongoing Authorization: Transitioning to Near Real-Time Risk Management

Abstract

Office of Management and Budget (OMB) Memorandum M-14-03, Enhancing the Security of Federal Information and Information Systems, stated that, “Our nation's security and economic prosperity depend on ensuring the confidentiality, integrity and availability of Federal information and information systems” and directs the National Institute of Standards and Technology (NIST) to publish guidance establishing a process and criteria for federal agencies to conduct ongoing assessments and authorization. The following additional guidance amplifies current NIST guidance on security authorization and ongoing authorization (OA) contained in Special Publications 800-37, 800-39, 800-53, 800-53A, and 800-137. This guidance does not change current OMB policies or NIST guidance with regard to risk management, information security, security categorization, security control selection, implementation, assessment, continuous monitoring, or security authorization.