NIST SP 800-53 PM-10 Authorization Process

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

Authorization processes for organizational systems and environments of operation require the implementation of an organization-wide risk management process and associated security and privacy standards and guidelines. Specific roles for risk management processes include a risk executive (function) and designated authorizing officials for each organizational system and common control provider. The authorization processes for the organization are integrated with continuous monitoring processes to facilitate ongoing understanding and acceptance of security and privacy risks to organizational operations, organizational assets, individuals, other organizations, and the Nation.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for PM-10 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

the security state of organizational systems and the environments in which those systems operate are managed through authorization processes;
the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes;
individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;
the authorization processes are integrated into an organization-wide risk management program.

Examine

[SELECT FROM: Information security program plan; privacy program plan; procedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process; assessment, authorization, and monitoring policy; assessment, authorization, and monitoring procedures; system authorization documentation; lists or other documentation about authorization process roles and responsibilities; risk assessment results relevant to the authorization process and the organization-wide risk management program; organizational risk management strategy; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for management of the authorization process; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Organizational processes for authorization; mechanisms supporting the authorization process].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

Not applicable at this tier.

HIGH

Base control: Added (beyond standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for PM-10. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

Information security program plan
privacy program plan
assessment, authorization, and monitoring policy
risk assessment results relevant to the authorization process and the organization-wide risk management program
organizational risk management strategy

Testing

Organizational processes for authorization
mechanisms supporting the authorization process

Other Records

procedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process
assessment, authorization, and monitoring procedures
system authorization documentation
lists or other documentation about authorization process roles and responsibilities
other relevant documents or records