خطوة Authorize من NIST RMF: حزمة التفويض لمسؤول التفويض (Authorizing Official)، مع ملخص النظام وتصنيفه، والضوابط ونتائج التقييم، وخطة العمل والمراحل، والخطر المتبقي، وقرار التفويض الذي يوثّقه مسؤول التفويض بنفسه.
المحتوى
1. محتويات الحزمة
2. النظام وتصنيفه
3. ملخص الضوابط والتقييم
4. خطة العمل والمراحل (POA&M)
5. الخطر المتبقي
6. قرار التفويض
ما تقدمونه
Residual risks to bring to the Authorizing Official — One risk per entry.
Authorizing Official (role)
System impact level (FIPS 199) — When the categorization is not selected as a source.
Controls and assessment results — When they are not selected as sources: the baseline, the controls in place, what the assessment found.
Plan of action and milestones — One row per entry, e.g. AC-2: dormant accounts found; IT manager; Automate the review; March 2028
Number of pages — Target length when the AI writes the document. If left empty: the usual length of this kind of document.
Language of the document — Applied when the AI writes the document.
Roles and owners — Who is responsible for which area. Owners in the result are taken from here; where no role covers an area, the owner is left for you to fill.
Additional context — Anything the service should take into account.
Title — As it will appear on the result.
Author — Shown as the author of the deliverable; never filled in by the AI.
Sections, in order — The template's sections are proposed, one per line in order: drag to reorder, rename, remove or add.
