
What happens after a system is authorized? The controls have been assessed. The vulnerabilities have been documented. The security plan is complete. The Authorizing Official accepts the residual risk, and the system receives its Authorization to Operate. Then...