Watch the explanation. Practice the skill.
RMF and the Authority to Operate
Show that an access control works before calling it implemented.
Captions appear here during playback.
RMF and the Authority to Operate
Show that an access control works before calling it implemented.
Video playback is unavailable. Read the descriptive transcript below, go directly to practice, or open the video file.
Source-based teaching example · Fictional data · Reviewed 2026-10-03. Microsoft Mark · locally synthesized. On a small screen, use fullscreen for diagram details or read the transcript.
Read the descriptive transcript
0:00 · What you will learn
Show that an access control works before calling it implemented.
What appears on screen
Show that an access control works before calling it implemented.
0:06 · The idea
A planned control is different from a tested control. Provider evidence does not replace your application’s access checks. Route authorization decisions to the responsible official.
What appears on screen
A planned control is different from a tested control. Provider evidence does not replace your application’s access checks. Route authorization decisions to the responsible official.
0:21 · One useful term
RMF. Risk Management Framework: a structured process for managing system security and privacy risk.
What appears on screen
Risk Management Framework: a structured process for managing system security and privacy risk.
0:32 · A worked example
ORION’s hosting is assessed, but its search index returns the same documents to everyone. Reader A receives Reader B’s restricted document. That is an application access failure.
What appears on screen
ORION’s hosting is assessed, but its search index returns the same documents to everyone. Reader A receives Reader B’s restricted document. That is an application access failure.
0:47 · Your turn to think
Can a careful prompt or hosting assessment repair that access leak? Pause and decide before continuing.
What appears on screen
Can a careful prompt or hosting assessment repair that access leak? Pause the video if you need more time.
1:04 · Why this answer works
No. Enforce and test application permissions. A checklist without results does not demonstrate the control.
What appears on screen
No. Enforce and test application permissions. A checklist without results does not demonstrate the control.
1:15 · Check 1
Test allowed and denied access.
What appears on screen
Test allowed and denied access.
1:20 · Check 2
Distinguish planned from implemented controls.
What appears on screen
Distinguish planned from implemented controls.
1:26 · Check 3
Preserve the legitimate authorization role.
What appears on screen
Preserve the legitimate authorization role.
1:31 · Now try a different case
Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.
What appears on screen
Open the lesson Try the new case Check and revise The full task and its requirements are in the linked lesson.
Watching explains the example. Complete the lesson practice to check what you can do. Explore all visual lessons →