Canada ITSG-33 - IT Security Risk Management A1-4.5: 4.5 Maintain authorization

What does A1-4.5 require?

The department keeps each system's authorization to operate current by periodically reviewing the security category of supported activities, reassessing threats and the technical environment, reviewing control assessment results, and checking that operations groups have kept the system's posture as set in the operations plan. When residual risk is no longer acceptable it applies temporary measures (for example disconnecting from the internet or invoking part of the contingency plan), corrects deficiencies, or accepts the new risk; the authorizer may revoke the authority to operate pending remediation. Review frequencies are set in the departmental security plan or by the authorizer, and outputs are updated residual risk assessments and operations-plan security provisions with mitigation plans and schedules.