public:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
public:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1public:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
Line 1: Line 1:
 +====== Authorizing Authority ======
  
 +[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
 +
 +===== Discussion =====
 +
 +An Authorizing Authority holds the assigned responsibility and authority to evaluate risk and issue, deny, restrict, suspend, or withdraw an [[public:99_annexes:annex-b-terms-and-definitions:o:operational_approval|Operational Approval]] for a defined system, service, facility, organization, or operational capability.
 +
 +The Authorizing Authority considers applicable requirements, implemented controls, assessment results, identified risks, operating conditions, and supporting [[public:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]. The authority records the resulting decision and any associated conditions, restrictions, or period of applicability.
 +
 +An Authorizing Authority may represent an individual, organizational role, committee, public body, contractual authority, or other governance body with formally assigned decision authority.
 +
 +[[public:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] produces controlled artifacts and evidence that support evaluation. Crucible does not act as the Authorizing Authority.
 +
 +===== Definition =====
 +
 +//individual, role, organization, or governance body with assigned authority to evaluate risk and issue, deny, restrict, suspend, or withdraw an [[public:99_annexes:annex-b-terms-and-definitions:o:operational_approval|operational approval]]//
 +
 +===== Source =====
 +
 +Generalised from security-authorization, accreditation, governance, and risk-management usage and specialized for the Crucible architecture and operational model.
 +
 +===== Note =====
 +
 +The title, legal authority, jurisdiction, and decision process associated with an Authorizing Authority vary among organizations and regulatory regimes.
 +
 +An assessor, auditor, compliance officer, or evidence producer does not become an Authorizing Authority solely by performing an assessment or preparing evidence.
 +
 +===== Example =====
 +
 +A designated governance body reviews the assessment results, residual risks, operating procedures, and compliance evidence for a Software Factory. The governance body acts as the Authorizing Authority when it issues the factory’s Operational Approval.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>