This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook

For the Authorizing Official: Evidence over Attestation

A one-page brief for the meeting that approves the pre-flight

A one-page brief for the authorizing official: every risk the program carries reaches them in writing with an end date, and in return gates are decided from data and evidence comes out of the work itself. Word download included.

One of four reader briefs that expand the pitches in Making the Case at Your Agency. Hand it over before the meeting, with The One-Page Ask.

Download	Use
Brief_for_the_Authorizing_Official.docx	The brief below, one page, with your number to fill in

Design guidance

The pitch and the framing are this workbook’s design guidance. The facts come from the chapters under Go deeper, where each is footnoted to its primary source.

The brief

The point: you’re the only official who can accept security and privacy risk on the agency’s behalf. The program brings you every risk it carries, in writing, with an end date. In return, you get evidence produced by the work itself, in place of attestation assembled before each assessment.

What you hold

Authorization of systems and boundary changes, and acceptance of residual risk.
Approval of plans of action and milestones.
Legacy authentication and NTLM end dates, because keeping legacy authentication open is a risk acceptance and BOD 25-01 makes blocking it a mandatory baseline.
Deviations from the mandatory BOD 25-01 baselines, which agencies must explain when they report.

What you get in return

Property	What it means for you
Gates from data	Gate criteria are evaluated from data, not executive signature
Every change a plan	Every plan produces an evidence packet
Packages from the source	Authorization packages regenerate from the source instead of spreadsheets
Gated actuation	A person approves a corrective action before it runs, with a dry run before production
High-risk changes stay gated	Operations with a high blast radius, such as tenant-wide role changes, stay gated permanently

What we ask of you

Agree the risk-acceptance rows of the decision matrix before the program starts.
Put the end date of every exception on your calendar.
Support the four-week pre-flight. Its assessment is read-only, and it shows you the estate as it really is.

Our number

Open risk acceptances: [count] Past their end date: [count]

Go deeper

Topic	Chapter
The authorizing official’s role, and gated actuation	Book 01, Chapter 09
Decision rights	Book 01, Chapter 09
The governance properties	Book 01, Chapter 09
Gate criteria and gate authorities	Book 01, Chapter 12

Continue

← For the CHCO · The One-Page Ask · Start Here

Version and revision history

Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.

Versions of this guide, newest first
Version	Edition	Date	Changes
2.0	2026.11.5	2026-11-08	Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Meeting pack: The One-Page Ask, Charter Sign-Off Sheet and four reader briefs (#390); Approve 116 gated pages (Nov 7); fix RMF map stale-review test (#457); Release 2.0: Draft becomes Baseline (#491)