PM-10: Authorization Process

individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;

the authorization processes are integrated into an organization-wide risk management program.

Information security program plan

privacy program plan

procedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process

assessment, authorization, and monitoring policy

assessment, authorization, and monitoring procedures

system authorization documentation

lists or other documentation about authorization process roles and responsibilities

risk assessment results relevant to the authorization process and the organization-wide risk management program

organizational risk management strategy

other relevant documents or records

Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for management of the authorization process

organizational personnel with information security and privacy responsibilities

Organizational processes for authorization

mechanisms supporting the authorization process