What Is Assessment and Authorization (A&A)? A Complete Guide
Introduction
Before any system goes live in a federal environment, or in any organization serious about managing security risk systematically, someone has to answer a fundamental question: Do we actually know what risks this system introduces, and have the right people formally decided those risks are acceptable?
That question is what Assessment and Authorization is designed to answer.
A&A is one of those terms that gets used frequently in government and defense contracting circles but is less commonly understood outside those contexts. That is a gap worth closing, because the discipline A&A represents, structured risk evaluation and formal authorization before systems operate, is relevant to any organization that wants to move beyond ad hoc security decisions and build a genuinely accountable approach to information security governance.
This guide explains what A&A is, where it comes from, how it works in practice, what the NIST Risk Management Framework has to do with it, and why organizations outside the federal space are increasingly adopting its principles.
What Is Assessment and Authorization?
Assessment and Authorization is a structured process for evaluating the security of an information system and formally determining whether the risks associated with operating that system are acceptable given the organization’s mission, security requirements, and risk tolerance.
The two parts of the name reflect two distinct activities that happen in sequence.
The assessment is the evaluation phase. A qualified assessor (typically independent from the team that built or manages the system) examines the security controls in place, tests whether those controls are working as designed, and documents the findings. The output is an honest picture of the system’s security posture: what is working, what is not, and what vulnerabilities or gaps remain.
The authorization is the decision phase. Based on the assessment findings, a designated official reviews the risk picture and makes a formal, documented decision: this system is authorized to operate (with any remaining risks accepted), or it is not authorized until identified issues are resolved.
That formal decision matters. Authorization is not a rubber stamp. It is an accountable governance act where a named individual with appropriate authority takes documented ownership of the decision that a system’s risk profile is acceptable enough for it to operate. If something goes wrong later, there is a clear record of who evaluated the risks and who approved the system’s operation.
The Origins of A&A: FISMA, NIST, and the Federal Context
Assessment and Authorization as a formal discipline is most closely associated with US federal information security requirements, specifically the Federal Information Security Modernization Act and the NIST Risk Management Framework.
FISMA compliance requires federal agencies and their contractors to implement structured security programs for information systems that process, store, or transmit federal information. A core component of that requirement is the A&A process: before a system goes into production use, it must be assessed against defined security controls and formally authorized by an Authorizing Official.
The NIST Risk Management Framework provides the structured methodology for carrying out that requirement. The RMF is a six-step process that takes a system from initial categorization through control selection, implementation, assessment, authorization, and continuous monitoring. A&A sits at the heart of steps four and five of that framework.
Historically, A&A was also referred to as Certification and Accreditation, or C&A, in earlier federal security guidance. The terminology shifted to Assessment and Authorization under NIST SP 800-37 to better reflect the nature of the activities and to align with modern risk management language. The concepts are largely the same, but A&A is the current preferred terminology.
The NIST Risk Management Framework: The A&A Backbone
Understanding A&A properly requires understanding the framework it operates within. The NIST RMF is a six-step lifecycle that connects system security decisions to organizational risk management:
Step 1: Categorize
The system is categorized according to the potential impact (low, moderate, or high) of a security breach on confidentiality, integrity, and availability. This categorization, defined by FIPS 199 and FIPS 200, determines the baseline security controls that apply to the system.
Step 2: Select
Based on the categorization, the organization selects an appropriate set of security controls from NIST SP 800-53. Controls can be tailored to add, remove, or adjust based on the organization’s specific operating context, risk tolerance, and overlays.
Step 3: Implement
The selected security controls are implemented in the system and the supporting infrastructure. Implementation is documented in a System Security Plan, which becomes the primary artifact describing how the system meets its security requirements.
Step 4: Assess
This is the assessment phase of A&A. An independent assessor evaluates whether the controls are implemented correctly, operating as intended, and producing the expected security outcomes. The assessor uses a combination of interviews, documentation review, observation, and technical testing to gather evidence. Findings are documented in a Security Assessment Report.
Step 5: Authorize
This is the authorization phase. The Authorizing Official reviews the Security Assessment Report, the System Security Plan, and a Plan of Action and Milestones that documents how identified weaknesses will be addressed. Based on that package, the AO makes the formal authorization decision and documents it in an Authorization Decision document.
Step 6: Monitor
Authorization is not permanent. After a system is authorized, its security posture must be continuously monitored to detect changes, new vulnerabilities, and emerging risks. When significant changes occur, a reassessment may be required. Authorization decisions typically have a defined validity period, often three years in federal environments, after which a full reassessment is required.
This framework reflects something important: A&A is not a one-time event. It is a continuous cycle that keeps the risk picture current as systems, threats, and operating environments evolve.
Key Roles in the A&A Process
A&A involves several distinct roles, each with specific responsibilities:
System Owner
The System Owner is responsible for the overall procurement, development, integration, modification, operation, maintenance, and disposal of the system. In the A&A context, the System Owner prepares the System Security Plan, coordinates the implementation of security controls, and works with the assessor during the assessment phase.
Authorizing Official (AO)
The AO is the senior official with the authority to formally accept the security risk associated with operating the system on behalf of the organization. This role cannot be delegated to a committee or shared informally. It is individual accountability for a specific risk decision. In federal environments, the AO is typically a senior agency official at the SES level or equivalent.
Security Control Assessor (SCA)
The assessor is responsible for independently evaluating the security controls in place and documenting the findings. Independence matters here: the assessor should not be the same person or team responsible for implementing the controls, because self-assessment produces less credible results and creates obvious conflicts of interest.
Information System Security Officer (ISSO)
The ISSO supports the system owner in implementing and maintaining the security program for the specific system, coordinating A&A activities, maintaining security documentation, and supporting continuous monitoring.
Common Control Provider
In many organizations, some security controls are provided centrally and inherited by multiple systems. For example, physical security, network infrastructure, and identity management may be centrally operated and available as common controls. The Common Control Provider documents and maintains those controls so individual systems can inherit them rather than implementing them independently.
The A&A Package: Key Documentation
A complete A&A submission includes several core documents that together tell the story of the system’s security posture and the risk decision being made.
System Security Plan (SSP)
The SSP is the primary document describing the system: its purpose, boundaries, operating environment, connections to other systems, user community, and most importantly, the security controls in place and how each one is implemented. It is the comprehensive reference document that assessors and the AO use to understand the system’s security posture.
Security Assessment Plan (SAP)
Before assessment activities begin, the assessor documents the planned approach: which controls will be tested, what testing methods will be used, the assessment schedule, and any assessment boundaries or constraints. The SAP ensures that assessment activities are planned and agreed upon before execution.
Security Assessment Report (SAR)
The SAR is the output of the assessment: a detailed record of findings for each control tested, including whether the control was found to be satisfied, other than satisfied, or not applicable, along with the evidence supporting each finding and recommendations for addressing weaknesses.
Plan of Action and Milestones (POA&M)
The POA&M documents identified weaknesses and deficiencies, the planned corrective actions for each, assigned owners, and target completion dates. It is a living document that tracks remediation progress after authorization. The POA&M is one of the key tools through which ongoing accountability for identified risks is maintained.
Authorization Decision Document
The formal record of the AO’s decision, specifying whether the system is authorized to operate, the conditions or requirements attached to the authorization, the authorization termination date, and the AO’s signature.
A&A in Practice: What the Process Actually Looks Like
The formal documentation tells part of the story. What actually happens during an A&A process is worth understanding more concretely.
The process typically begins well before the formal assessment. The system owner and ISSO work together to prepare the SSP, which requires a thorough understanding of the system’s architecture, data flows, connections, user population, and the controls in place. This preparation phase often reveals gaps that need to be addressed before assessment even begins.
When the assessor arrives, their work combines several activities. They review documentation to understand what controls are supposed to be in place. They conduct interviews with system administrators, security personnel, and sometimes users to understand how controls actually operate in practice. They observe systems and processes directly. And for technical controls, they conduct testing, examining configurations, reviewing logs, attempting to identify vulnerabilities, and verifying that controls respond as expected.
The gap between documentation and practice is one of the most consistent findings in security assessments. A policy may require password complexity enforcement, but the assessor may find that the system’s configuration does not actually enforce it. A procedure may specify that access is reviewed quarterly, but the records may show it has not been done in eighteen months. Assessment brings those gaps into the open.
After the assessment, the SAR documents what was found. The system owner reviews the findings, works with the development and operations team to address the most critical ones before submission, and documents the rest in the POA&M with realistic remediation timelines.
The AO then reviews the complete package. This is not a brief review. A thoughtful AO examines the nature and severity of the findings, the adequacy of the POA&M, the operating environment and mission context, and any compensating controls or mitigating factors. The authorization decision is a genuine risk judgment, not an automatic approval.
Why A&A Matters Beyond the Federal Sector
A&A is a mandatory requirement for federal systems and federal contractors. But the discipline it represents, structured risk assessment followed by accountable authorization decisions, is valuable for any organization that takes security governance seriously.
Consider what A&A actually requires: an independent evaluation of security controls, honest documentation of gaps, formal accountability for the risk decision, and continuous monitoring after authorization. These are the building blocks of any mature security governance program, regardless of whether FISMA applies.
Organizations in healthcare, financial services, defense contracting, and critical infrastructure are increasingly adopting A&A-style approaches, often under different names (security reviews, system accreditation, security gate processes) but following similar logic. The core principle is the same: before a system goes into production, someone with appropriate authority should be able to answer, with documented evidence, whether that system’s risk profile is acceptable.
This principle also matters for cybersecurity compliance more broadly. Organizations that implement A&A-style processes for significant system changes tend to have stronger overall security postures than those that allow systems to go live based on informal judgment or checkbox reviews.
Common A&A Challenges
Assessment independence is compromised
When the team that built the system also assesses it, the results are inherently less credible. Self-assessment creates pressure to underreport findings and overstate control effectiveness. Organizations should invest in genuine independence for the assessor role, whether through a separate internal team or an external assessor.
Documentation lags behind implementation
The SSP and other A&A documentation need to reflect the current state of the system, not how it was designed two years ago. In fast-moving environments, keeping security documentation current is a significant challenge. Organizations often arrive at assessment with outdated SSPs that do not reflect system changes made since the last review.
POA&M items accumulate without closure
The POA&M is supposed to be a living document that tracks remediation to closure. In practice, many organizations allow POA&M items to accumulate without being addressed, which means the same weaknesses appear in successive assessments. Tracking POA&M remediation with clear owners and realistic timelines is essential for the process to have meaning.
Authorization becomes a formality
When AOs sign authorization decisions without genuinely engaging with the security findings, authorization becomes a formality rather than a governance act. The value of A&A depends entirely on the AO actually understanding and accepting the risks they are approving. Organizations need to invest in training and support for AOs so that authorization decisions reflect genuine informed judgment.
Treating A&A as a one-time exercise
Authorization is not permanent. Systems change, threats evolve, and the risk picture that justified authorization two years ago may not reflect current conditions. Continuous monitoring, triggered reassessments for significant changes, and periodic reauthorization are all essential to maintaining the security posture that the original authorization was based on.
Best Practices for a Streamlined A&A Process
Adopt a Risk-Based Approach
Not all systems present the same risk profile. Systems that process sensitive personal data, financial information, or operationally critical functions warrant more intensive assessment than lower-risk administrative tools. Calibrating assessment depth and rigor to the actual risk level of the system makes the program more efficient without reducing security outcomes for the highest-risk systems.
Engage Stakeholders Early
A&A involves security, IT, compliance, legal, business operations, and senior leadership. Starting the process late, or bringing stakeholders in only when documentation needs to be signed, creates avoidable delays and gaps. The system owner should engage the assessor and the AO early, well before the assessment begins, to align on scope, expectations, and timelines.
Maintain Documentation Continuously
One of the most common sources of delay in A&A is outdated or incomplete documentation. Organizations that maintain their SSPs and other security artifacts continuously, updating them as systems change rather than scrambling to update before an assessment, move through the process significantly faster and with more credible results.
Leverage Automation to Support Continuous Monitoring
The authorization step is not the end of A&A. Continuous monitoring is what keeps the authorization current and meaningful. Automated tools that track control performance, detect configuration changes, flag security events, and generate evidence of ongoing compliance make continuous monitoring sustainable rather than an aspirational requirement that is never actually implemented.
Treat the POA&M as an Operational Tool
The Plan of Action and Milestones is not just a compliance document. It is a risk management tool that tracks the organization’s commitment to addressing identified weaknesses. Treating it seriously, assigning real owners with realistic deadlines, and following up on closure are what give the A&A process credibility beyond the initial authorization decision.
How VComply Supports A&A and Security Authorization Programs
Managing an A&A program involves a significant volume of documentation, task coordination, and ongoing monitoring. Doing it manually, across spreadsheets, shared drives, and email, creates exactly the gaps that assessors find: outdated SSPs, missing evidence, untracked POA&M items, and no real visibility into control performance between formal assessments.
VComply gives security and compliance teams a structured environment for managing the full A&A lifecycle.
Security control requirements can be organized and mapped to specific systems within VComply. Control owners are assigned with clear responsibilities, recurring monitoring activities are scheduled with automated reminders, and evidence is captured directly within the platform as controls are performed.
POA&M items identified during assessment are tracked through remediation with assigned owners, target dates, and escalation workflows. When items are overdue, leadership is automatically notified. When items are closed, the evidence is documented and linked to the original finding.
For organizations managing multiple systems through simultaneous A&A processes, VComply provides dashboard visibility into the status of each system: which controls are current, which have open findings, which POA&M items are approaching their target dates, and what the overall authorization status of each system looks like. This visibility turns A&A from a periodic documentation project into a continuous governance program.
When assessors or oversight bodies request evidence of control performance or POA&M status, the information is organized, current, and immediately accessible.
Conclusion
Assessment and Authorization is, at their core, governance disciplines. It is the practice of ensuring that before a system operates, someone has honestly evaluated its security risks and someone with appropriate authority has formally accepted responsibility for those risks.
That discipline matters in federal environments where FISMA and the NIST RMF make it mandatory. But it matters equally in any organization that wants to move beyond informal security decisions and build a governance model where risk accountability is explicit, documented, and maintained over time.
The organizations that do A&A well are not the ones that treat it as a paperwork exercise before a deadline. They are the ones that invest in genuine assessment independence, keep their documentation current, track remediation with real urgency, and maintain continuous monitoring that keeps authorization meaningful long after the initial decision is made.
That kind of discipline requires structure, ownership, and the right tools to sustain it at scale.
Ready to build a structured security authorization and continuous monitoring program? Book a personalized demo with VComply and see how our platform helps security and compliance teams manage controls, track remediation, and maintain audit-ready documentation across every system in your environment.