PAM 25-2-12 — Authorizing Official
PAM 25-2-12 governs the nomination, appointment, training, certification, and duties of authorizing officials for Army systems.
- Publication number: PAM 25-2-12
- Title: AUTHORIZING OFFICIAL
- Date: 04/08/2019
- Proponent: G-6
- Status: ACTIVE
View PAM 25-2-12 on armypubs.army.mil
Related publications
It covers Army roles in the authorizing official appointment process, supporting representatives, repository management, system changes, transfers, and decommissioning. It requires eligibility qualifications, training and certification, authorization decisions, and use of RMF processes for information systems and platform information technology systems.
Topics covered
- Authorizing official nominations
- Authorizing official appointments
- Training and certification requirements
- Risk Management Framework policy
- Authorizing official designated representatives
- Authorizing official repository
- System transfers and decommissioning
Questions and answers
What qualifications are required to be nominated as an authorizing official?
To be nominated as an AO, the individual must (1) Be a U.S. citizen. (2) Be a DoD official. (3) Be a general officer (GO), senior (Federal) official, senior executive service (SES), or equivalent. (paragraph 2-3)
What training must an authorizing official complete before nomination?
Prior to nomination, the nominee must complete the DoD-required AO computer based training (CBT) accessible on the Information Assurance Virtual Training Center located at https://iatraining.us.army.mil. (paragraph 3-2)
How often must authorizing officials retake the DoD AO computer-based training?
The Army AO CBT meets the DoD AO certification requirement. AOs must retake the DoD AO CBT every 3 years and the upload the latest certificate of completion to the AOs profile in ATCTS at https://atc.us.army.mil. (paragraph 3-2)
When can an interim authorization to test be granted?
Grant an IATT only when an operational environment or live data is required to complete specific test objectives (for example, when replicating certain operating conditions in the test environment is impractical) and expiring at the completion of testing (normally for a period of less than 90 days). (paragraph 2-3)
What termination date must an authorization to operate specify?
The ATO must specify an authorization termination date that does not exceed three years from the authorization date. (paragraph 2-3)