Authority to operate (ATO) · Wiki

An authority to operate, or ATO, is a formal decision by a designated senior official to accept the security and privacy risk of operating an information system. In US federal and defence practice it is the output of the Risk Management Framework, and no system handling government information is normally supposed to run in an operational environment without one. The term is also used informally for the whole approval process.

How it works

The Risk Management Framework, published by the US National Institute of Standards and Technology, sets out seven steps: prepare, categorise, select, implement, assess, authorise and monitor. A system is first categorised by the impact a compromise would have on it and its information. Security and privacy controls are then selected from NIST Special Publication 800-53, put in place and documented, and tested by an assessor. In the authorise step a senior official reviews the evidence and makes a risk-based decision on whether the system may operate. The final step, monitoring, tracks control performance and changes in risk after the decision.

The US Department of Defense applies the framework to its own systems, and the evidence behind a decision is assembled by the programme and reviewed before the official decides. Significant changes to a system can call for the evidence to be revisited.

The move to continuous authorisation

The traditional model treats authorisation as a point-in-time event, tied to a particular version of a system. That fits poorly with software released weekly or daily. The Department’s February 2022 Software Modernization Strategy states that many Department components regard obtaining an ATO as the longest step in developing and deploying software. It proposes shifting authorisation from a checklist exercise across hundreds of controls toward continuous authorisation, in which automation produces ongoing evidence of the security of the development platform, the process and the resulting software.

This idea is usually called continuous ATO, or cATO. In the strategy’s framing, the object of assurance moves from a single release to the pipeline and the team that produce releases, with monitoring supplying evidence in near real time.

Who is involved

Authorising officials, system owners, security control assessors, programme offices and the software suppliers that must meet the requirements all take part. Other governments run their own accreditation processes under national rules, so combined systems may need approvals from more than one authority.

Why it matters

Approval time is a practical constraint on software-defined defence. A capability that can be built in weeks but takes many months to authorise does not reach operators at the rate its architecture allows. Authorisation also decides which suppliers can compete, because meeting the evidence burden favours organisations with mature tooling. For networked systems such as command and control applications, authorisation is also the mechanism by which a shared environment stays trusted as components change.

What to watch

Points of interest include how many programmes obtain continuous authorisation and on what criteria, whether reciprocity between authorising officials reduces repeated assessment, how automated evidence is validated, and whether allies recognise each other’s decisions.