Reauthorization $($i$.$e$.,$ going through all six steps of the NIST RMF process$)$ is required after a specified period, which is typically two or three years or when there has been a significant change to an IT system.

Research the decision process for reauthorization.

Explain the process and include the major stakeholders in the process for deciding on reauthorization. Discuss how security metrics would cause the need for reauthorization.