The traditional answer
In a central model, someone in the security office approves each system to operate. Approvals queue up behind a few people, who are signing for systems they do not run and cannot change.
The federated answer
In FCR the resource team makes its own risk-informed decisions, and that includes the decision to operate. The resource owner is accountable for it.
The security office is not an authorization gate. It provides the programs, standards and guidance that help the team decide well.
What the decision rests on
A decision to operate has to rest on an actual risk assessment. The owner approves a security plan that shows the risks, the controls in place, the controls planned, and any risks that have been accepted.
The record matters more than the route
How approval is routed can vary. The risk manager may send the plan to the resource owner or to another approver, or an owner who did the assessment may approve it directly.
What cannot vary is the record: who decided, when, and on what basis. Accepted risks are part of it, documented and reviewable.
What the security office still does
- States the organization's risk appetite and tolerance, so owners know what is acceptable.
- Sees the decisions in aggregate, and whether plans are being kept current.
- Supports the cases where an owner needs an expert.
Governance for a Federated Program covers the first of these.