- Home
- All questions
- Question 14
CompTIA Security+ study material · question 14 of 611
Who makes the decision to accept a system's residual risk and issue an authorisation to operate?
Show the answer
Answer: B. The authorising official
Authorisation is a management decision by a named official. The assessor produces evidence but does not accept risk.
Source: NIST SP 800-37 Rev. 2 (NIST) — SP 800-37 Rev. 2 § 3.6 Authorize