U.S. Department of Health and Human Services
The Authorization Decision Document considers the following:
Is the actual risk to agency operations, assets, or individuals consistent with the risk assessment? Can the selected security controls achieve the desired level of assurance? Have actions been taken or planned to correct any weaknesses in the security controls? How does the security control assessment translate into actual risk to HHS, and is the risk acceptable?
At the completion of security authorization, a system is authorized to operate in a production environment.
Page 9 of 9
Implementation & Assessment Phase
Security Authorization Document