---

id: "CA-06(01)" title: "Joint Authorization — Intra-organization" family: "CA" family_name: "Assessment, Authorization, and Monitoring" sort_id: "ca-06.01" priority: "P1" implementation_level: "organization" parent: "CA-06" enhancement: True

---

Statement

Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.

Guidance

Assigning multiple authorizing officials from the same organization to serve as co-authorizing officials for the system increases the level of independence in the risk-based decision-making process. It also implements the concepts of separation of duties and dual authorization as applied to the system authorization process. The intra-organization joint authorization process is most relevant for connected systems, shared systems, and systems with multiple information owners.

Assessment Objective: a joint authorization process is employed for the system;

Assessment Objective: the joint authorization process employed for the system includes multiple authorizing officials from the same organization conducting the authorization.

Assessment, authorization, and monitoring policy

procedures addressing authorization

system security plan

privacy plan

assessment report

plan of action and milestones

authorization statement

other relevant documents or records

Organizational personnel with authorization responsibilities

organizational personnel with information security and privacy responsibilities

Mechanisms that facilitate authorizations and updates