Authorizing Authority [Dido Solutions, Inc Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Authorizing Authority ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

An Authorizing Authority holds the assigned responsibility and authority to evaluate risk and issue, deny, restrict, suspend, or withdraw an [[dido:99_annexes:annex-b-terms-and-definitions:o:operational_approval|Operational Approval]] for a defined system, service, facility, organization, or operational capability.

The Authorizing Authority considers applicable requirements, implemented controls, assessment results, identified risks, operating conditions, and supporting [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]. The authority records the resulting decision and any associated conditions, restrictions, or period of applicability.

An Authorizing Authority may represent an individual, organizational role, committee, public body, contractual authority, or other governance body with formally assigned decision authority.

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] produces controlled artifacts and evidence that support evaluation. Crucible does not act as the Authorizing Authority.

===== Definition =====

//individual, role, organization, or governance body with assigned authority to evaluate risk and issue, deny, restrict, suspend, or withdraw an [[dido:99_annexes:annex-b-terms-and-definitions:o:operational_approval|operational approval]]//

===== Source =====

Generalised from security-authorization, accreditation, governance, and risk-management usage and specialized for the Crucible architecture and operational model.

===== Note =====

The title, legal authority, jurisdiction, and decision process associated with an Authorizing Authority vary among organizations and regulatory regimes.

An assessor, auditor, compliance officer, or evidence producer does not become an Authorizing Authority solely by performing an assessment or preparing evidence.

===== Example =====

A designated governance body reviews the assessment results, residual risks, operating procedures, and compliance evidence for a Software Factory. The governance body acts as the Authorizing Authority when it issues the factory’s Operational Approval.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>