Authorizing official

{
  "id": "MLC-T-CYB-000358",
  "term": "Authorizing official",
  "field": "Cybersecurity",
  "definition": "1. Official with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals. Synonymous with Accreditation Authority.\n\n2. A senior Federal official or executive with the authority to authorize (i.e., assume responsibility for) the operation of an information system or the use of a designated set of common controls at an acceptable level of risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation. Formerly known as \"accrediting official\" or \"accrediting authority\" or \"designated accrediting authority\".\n\n3. A senior (federal) official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.\n\n4. Senior (federal) official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.\n\n5. A senior (federal) official or executive with the authority to formally assume responsibility for operating a system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.\n\n6. A senior Federal official or executive with the authority to authorize (i.e., assume responsibility for) operation of an information system or the use of a designated set of common controls at an acceptable level of risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation.\n\n7. See Authorizing Official.\n\n8. Senior federal official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.",
  "abbreviation": "AO",
  "synonyms": [
    "Accrediting Authority"
  ],
  "references": [
    "FIPS 200; NIST SP 800-60 Vol. 1 Rev. 1 from FIPS 200; NIST SP 800-60 Vol. 2 Rev. 1 from FIPS 200",
    "CNSSI 4009-2022 from OMB Circular A-130 (2016); NIST SP 800-161r1-upd1 [11/1/2024 errata update] from NIST SP 800-53 Rev. 5; NIST SP 800-37 Rev. 2 from OMB Circular A-130 (2016); NIST SP 800-53 Rev. 5 from OMB Circular A-130 (2016); NIST SP 800-53A Rev. 5 from OMB Circular A-130 (2016); NIST SP 800-53B from OMB Circular A-130 (2016)",
    "NIST SP 800-128; NIST SP 800-137",
    "NIST SP 800-30 Rev. 1; NIST SP 800-39",
    "NIST SP 800-12 Rev. 1",
    "NIST SP 800-128",
    "NIST SP 800-60 Vol. 1 Rev. 1; NIST SP 800-60 Vol. 2 Rev. 1",
    "NISTIR 7622",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/authorizing-official/"
}