Lion Cipher Lab
Assemble an authorization package and make a risk-based ATO decision (the NIST RMF authorize step)
- GRC / Compliance
- Intermediate
- ~55 min
- Free · no account required
Why it matters
Somewhere behind every system you use, a person decided it was safe enough to switch on. Not a scanner, not a checklist — a person, who put their name on the risk. That decision is the job everyone in GRC is eventually promoted into, and almost nobody practises it before they're handed it. This lab lets you rehearse it on a system small enough to fit in your head. You'll learn to draw a boundary, turn a pile of findings into one honest sentence about risk, choose between the four real decisions available to you, and write the memo. Even if you never work for a US federal agency, the skill…
What you'll learn
- assembling an authorization package
- drawing an authorization boundary
- residual-risk determination
- risk acceptance and accountability
- writing an authorization decision memo
- NIST Risk Management Framework
Steps in this lab
- What 'authorize' means, and who is actually signing
- Pick your system and lay out the package folder
- Draw the authorization boundary — the most-argued-about page in the package
- Assemble the three documents — and know which question each one answers
- Turn a list of findings into a statement of residual risk
- The four decisions actually available to you
- Write the decision memo
- Why the AO signs it and not the engineer — and why 'all green' is the wrong bar
- After the signature: ongoing authorization, and what this looks like outside government