2.9.4 Authorization Impact of Information Systems under NIST SP 800-37-1

Before · SP 800-79-1

After · SP 800-79-2

Authorization Impact of Information Systems under NIST SP 800-37-1

Before · SP 800-79-1

After · SP 800-79-2

An issuer must not be authorized to operate if one or more of its critical information systems is deemed insecure and therefore is issued a DATO according to [SP 800-37-1] . In the case where an IATO (under [SP 800-37-1] ) has been issued for an information system, the DAO may issue no greater than an IATO for the issuer. Once the [SP 800-37-1] IATO is replaced with an [SP 800-37-1] ATO, the DAO can issue a SP 800-79-2 ATO. If the [SP 800-37-1] ATO expires for one or more of information systems during the course of operation of an issuer, the OIMO shall assess the criticality of the system for operations and present the analysis to the DAO. The DAO then can exercise the following options:

 Specify a short time during which the information systems of the issuer must be re- authorized under [SP 800-37-1] without changing the ATO status;

 Downgrade the current SP 800-79-2 ATO to an IATO; or

 If circumstances warrant, issue a SP 800-79-2 DATO and halt all issuer operations.