Systems Authorization is described as?

• A. A process for validating security requirements before development begins.
• B. Formal management acceptance of risk and approval for software to be placed into production based on certain operating conditions; also known as accreditation.
• C. A plan for disaster recovery testing.
• D. A formal review of software to ensure that all security controls were built into the software as designed.

Answer: (D)

Systems Authorization focuses on the formal acceptance to operate by verifying that security controls are actually built into the software as designed and function as intended. This means a formal review of the software, with evidence that the security controls exist in the code and work properly, to support a risk-aware go-live decision. This emphasis on engineering verification of implemented controls distinguishes it from pre-development activities (validating requirements before coding), disaster recovery planning (recovery testing), or the broader accreditation/ATO process that centers on management-level risk acceptance rather than the engineering verification of controls.