READ MORE: Software factories are among the projects that could benefit from cATOs. The National Institute of Standards and Technology (NIST) defines an ATO, or an Authority to Operate, as the official management decision given by a senior federal official or officials to “authorize operation of an information system and to explicitly accept the residual risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations,” and the country, based on the deployment “of an agreed-upon set of security and privacy controls.” ATOs also apply to common controls inherited by agency information systems.ĪTOs are “informed by a security authorization package including at a minimum a system security plan, security assessment report, and plan of action and milestones that detail risks relating to implementation of required controls for an information system given its FIPS 199 Security Impact level and any additional controls that are tailored in to address specific agency and/or system specific security considerations,” says General Services Administration CISO Bo Berlas. Traditional ATOs also do not provide for continuous monitoring of risk the way cATOs are designed to do.Īdditionally, cATOs are seen as providing more up-to-date assessments of how cybersecurity functions in real-world conditions, since they are based on current known vulnerabilities rather than what was known at the time an assessment was made months or years ago.Ĭlick the banner to receive curated content by becoming an Insider.

The thinking is that, by the time an ATO is issued, it might already be out of date. Recently, however, the Defense Department and other agencies have indicated that it is time to move to a nimbler and more flexible framework known as continuous authorization to operate, or cATO. Essentially, ATOs have served as signoffs given to IT systems, whereby officials deem the level of inherent risk in deploying them acceptable enough for them to be used. Federal agencies have long followed the National Institute of Standards and Technology’s Risk Management Framework for Information Systems and Organizations to help agencies select the appropriate safeguards related to cybersecurity, privacy and supply chain risk management.Ī key component of how agency IT officials assess risk and deploy new information systems is an authorization to operate, or ATO.

Fed ato business process model example