An organization has developed a major application that has undergone accreditation testing.

The final step before the application can be accredited is the acceptance of risk by the authorizing official, who is responsible for making the final decision on whether to authorize the operation of the system or not. The authorizing official must review the results of the evaluation, the System Security Plan (SSP), and the residual risks, and determine if the risks are acceptable or not. The other options are not the final step, but rather part of the accreditation process. Remediation of vulnerabilities is done before the evaluation, adoption of standardized policies and procedures is done during the development, and approval of the SSP is done by the system owner, not the authorizing official. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5, p. 245; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 2, p. 63.