Definitions
Authorization
Authorization is the formal, official decision by a designated organizational official to allow the operation of an information system, explicitly accepting the risk that remains after implementing an agreed-upon set of security and privacy controls.
Control Assessment (Assessment)
Assessment is the systematic testing and evaluation of security and privacy controls to verify they are implemented correctly, operating as intended, and satisfying established security requirements for an information system.
Production
A system is considered in production when it has completed all implementation activities, all controls are in place, and it has been deemed suitable for use by the business owner and system owner. The formal approval for production is granted as an Authority to Operate (ATO).
Directive (CA-1: Security Assessment and Authorization)
GNB shall establish, implement, and maintain a formal Security Assessment and Authorization Directive to ensure that information systems are assessed for security risks, authorized prior to operation, and subject to ongoing monitoring throughout their lifecycle.
Purpose
This directive establishes the foundation for managing system‑level cybersecurity risk; enables transparent, risk‑based decision‑making; and ensures that systems operate only with approved, documented authorization.
The objective of the Security Assessment and Authorization Directive is to ensure that a standardized approach defines:
- performing periodic Security assessments, to determine the effectiveness of security controls, Gap evaluation, and the development action plans to correct the deficiencies
- authorization of the security design and implementation for systems, system components, or system services
