Authorization fundamentals
Authority to Operate Explained: From Authorization Package to Sustained Readiness
Definition
Authority to Operate (ATO)
An Authority to Operate (ATO) is a formal decision by an authorizing official to authorize operation of an information system and accept the associated risk, based on security assessment evidence.
The decision considers how effectively the system’s security controls are implemented, the assessment findings and the remaining risk to organizational operations and assets. Attaining ATO is a critical milestone for minimizing and managing risk for Department of War (DoW) systems and the contractors who support them.
But obtaining ATO is only part of the challenge. Security configurations change, new vulnerabilities emerge and compliance requirements evolve. Maintaining authorization readiness requires continuous monitoring and evidence that the system remains secure after the initial assessment.
Who Grants ATO and How Is It Tracked?
ATO is issued by an authorizing official (AO) who has the authority to accept risk on behalf of the organization. The AO reviews the system’s security authorization package to determine whether the risk is acceptable.
The package typically includes three key elements:
SSP
System Security Plan
Describing the system, its security requirements and how controls are implemented
SAR
Security Assessment Report
Documenting assessment results, including control effectiveness and identified weaknesses
POA&M
Plan of Action and Milestones
Tracking identified deficiencies, planned corrective actions and remediation milestones
Teams document and manage authorization evidence through platforms such as the Enterprise Mission Assurance Support Service (eMASS) and Xacta. These systems help organize security documentation, assessment results and remediation activities for AO review.
How Does the ATO Process Work Under CSRMC and RMF?
The DoW announced its Cybersecurity Risk Management Construct (CSRMC) on September 24, 2025. Its five phases—Design, Build, Test, Onboard and Operations—and ten guiding tenets emphasize integrating cybersecurity throughout a system’s lifecycle. One of those tenets, Continuous Monitoring and ATO, reflects a shift away from relying primarily on point-in-time assessments toward automated, continuous risk management.
CSRMC lifecycle phases
During the transition to CSRMC, the Risk Management Framework (RMF) remains the working process for authorization activities. Under DoD Instruction 8510.01, teams carry out the RMF steps described in NIST SP 800-37 Rev. 2:
RMF steps in NIST SP 800-37 Rev. 2
- PreparePrepare the organization and system
- CategorizeCategorize the system based on its impact level
- SelectSelect appropriate security controls
- ImplementImplement the controls
- AssessAssess their effectiveness
- AuthorizeAuthorize the system to operate
- MonitorMonitor security controls and risk continuously
Reform underwayDoW leadership has also indicated that the RMF and ATO processes are being overhauled, with reciprocity and commercial tools among the priorities.
What Types of Authorization Decisions Are Made?
An AO can make several types of decisions, depending on the system’s security posture and operational needs.
Approved
Authority to Operate (ATO)
Approves system operation based on the assessed security posture and accepted risk
Conditional
ATO with conditions
Authorizes operation subject to specified conditions, restrictions or remediation requirements
Test only
Interim Authorization to Test (IATT)
Permits a system to be used for approved testing activities, not general operational authorization
Denied
Denial of Authorization to Operate (DATO)
Indicates that the system is not authorized to operate
Legacy term
You may also encounter the term “Interim Authority to Operate” (IATO). This is a legacy term associated with the Defense Information Assurance Certification and Accreditation Process (DIACAP), which preceded RMF.
When granting an ATO, the AO establishes an authorization termination date based on the applicable requirements and circumstances. There is no universal fixed timeline that applies to every system. Where applicable policy permits and the AO approves, systems with effective continuous monitoring may transition to ongoing authorization.
Continuous Authorization to Operate (cATO) is a distinct approach for qualifying DevSecOps environments. Eligibility requires three competencies: continuous monitoring of controls, active cyber defense and an approved DevSecOps reference design. Continuous monitoring alone does not qualify a system for cATO; the AO must evaluate all three competencies under applicable guidance.
cATO eligibility requires all three competencies
Accelerate RMF and ATO timelines
Keep authorization evidence current between assessments
ConfigOS automates STIG compliance, remediation and continuous monitoring, and integrates with eMASS and Xacta.
Why Is Sustaining ATO So Difficult?
ATO reflects an assessed security posture, but that posture can change quickly. Security patches, administrator changes, software updates and configuration modifications can cause systems to drift from approved baselines.
Between assessments, posture can drift
In addition, new Security Technical Implementation Guides (STIGs) are released regularly, creating additional requirements for system owners. Findings that were previously resolved may also reappear between formal assessments. Without continuous monitoring (ConMon), these changes can go undetected until the next assessment exposes gaps in compliance.
Sustaining authorization readiness therefore requires more than passing an assessment. Teams must maintain hardened configurations, identify deviations, remediate findings and preserve current evidence demonstrating that controls remain effective.
What sustained authorization readiness requires
How ConfigOS Supports Authorization Readiness
SteelCloud’s ConfigOS unified automation solution helps organizations automate STIG compliance, remediation and continuous monitoring, reducing the manual effort required to maintain secure configurations and prepare authorization evidence.
The platform produces fully populated compliance checklists in bulk, combining automated scan results with manually collected check data. It also exports results in formats used by authorization and compliance workflows, including eMASS (ARF/ASR), Xacta, CKL and JSON formats.
Export formats for authorization workflows
These unified capabilities help teams harden systems, identify configuration drift, address findings and accelerate RMF and ATO timelines. By automating repetitive compliance tasks and keeping evidence current, ConfigOS can help organizations move from point-in-time remediation to continuous authorization readiness.
Decision authority
The authorizing official decides
The AO makes the authorization decision. ConfigOS supports authorization readiness by helping teams sustain hardened configurations and maintain current evidence. Schedule a demo of ConfigOS to see how unified automation can support that work as authorization practices evolve.
For a closer look at these capabilities, explore our RMF and ATO automation data sheet.
Authorization readiness
Sustain the Hardened Posture Required for Authorization
ConfigOS helps teams sustain hardened configurations and keep authorization evidence current as authorization practices evolve.
Frequently Asked Questions
What is Authority to Operate (ATO)?
An ATO is a formal decision by an authorizing official to authorize operation of an information system and accept the associated risk, based on security assessment evidence.
Who grants an ATO?
Only an authorizing official can grant ATO after reviewing the system’s security documentation, assessment results and identified risks.
How long is ATO valid?
The authorizing official sets the authorization termination date according to applicable policy and system circumstances. There is no single duration that applies to every system. Where policy permits and the AO approves, effective continuous monitoring may support ongoing authorization.
What is continuous ATO (cATO)?
Continuous Authorization to Operate (cATO) is an approach for qualifying DevSecOps environments that uses continuous security evidence to support ongoing risk management. It requires continuous control monitoring, active cyber defense and an approved DevSecOps reference design. Continuous monitoring alone is not sufficient.
Is IATO still used?
Interim Authority to Operate (IATO) is a legacy DIACAP-era term. Interim Authorization to Test (IATT) permits approved testing activities and does not authorize general operational use. It is not an equivalent replacement for IATO.
The Dopamine of Passing the Audit
Prev post
Featured Resources