ATO
Authorization to Operate Field Guide

Authorization to Operate (ATO), sometimes called Authority to Operate, is the official management decision given by a senior government official (the Authorizing Official) to authorize operation of an information system on behalf of a federal agency and to explicitly accept the risk to organizational operations, organizational assets, individuals, other organizations, and the nation based on the implementation of an agreed-upon set of security controls.

Every information system operated by or on behalf of the U.S federal government is required to meet Federal Information Security Modernization Act (FISMA) standards, which includes system authorization and an ATO signed by an Authorizing Official (AO), who thereby takes responsibility for the security and risks associated with operating that system. The AO is generally a very high-ranking official within a federal agency, such as a Chief Information Officer (CIO), Chief Information Security Officer (CISO), Chief Technology Officer (CTO), or Deputy Secretary. In order to convince the AO to sign off on an ATO, the security posture of the information system must be thoroughly documented.

The government official who is considered primarily responsible for completing the ATO process is called an Information Security Systems Officer (ISSO). ISSOs report to the agency’s senior Information Security Officer, Authorizing Official, management official, or information system owner. This may be the CIO, CISO, or CTO for the agency, or some other official within the agency responsible for information security. An ISSO is responsible for managing the security posture of information systems and programs, and will help to coordinate assembly of the Authorization Package for the AO’s approval.

Whenever a new software application or information system is being built by or for the federal government, it will have an ISSO assigned to it. ISSOs within federal agencies typically oversee multiple information systems, and they will clarify the agency-specific processes and documentation required to secure an ATO. It’s critical for technical staff on vendor teams to have a good relationship with their program’s ISSO and work with them to ensure that the program receives its ATO.

This guide is intended to acquaint people new to the government technology industry with the basics of an ATO. Achieving a signed ATO is a critical step in the process of creating a new software application for a federal agency, so it’s important for everyone who works on such applications to be conversant in the language used to discuss ATOs.

For all federal agencies, the Risk Management Framework (RMF) describes the process that must be followed to secure, authorize, and manage information systems. The RMF defines a process cycle that is used for initially securing the protection of systems through an ATO and integrating ongoing monitoring.

The RMF is a six-step process, most commonly associated with NIST SP 800-37, to architect and engineer a data security process for new information systems and suggests best practices and procedures each federal agency must follow when enabling a new system.

The Federal Information Processing Standards (FIPS) define three security objectives for information and information systems:

Confidentiality

“Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information...”
[44 U.S.C., Sec. 3542]

A loss of confidentiality is the unauthorized disclosure of information.

Confidentiality

“Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity...” [44 U.S.C., Sec. 3542]

A loss of integrity is the unauthorized modification or destruction of information.

Confidentiality

“Ensuring timely and reliable access to and use of information...” [44 U.S.C., SEC. 3542]

A loss of availability is the disruption of access to or use of information or an information system.

Every information system that has an ATO must be classified into one of three levels of potential impact to organizations and individuals should there be a breach of security (defined as a loss of confidentiality, integrity, or availability). FIPS Publication 199 defines these three levels as:

Low

The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

Moderate

The loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

High

The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

Risk management is a continuous process. Information systems are in a constant state of change with upgrades to hardware, software, or firmware and modifications to the surrounding environments where the systems reside and operate. A structured approach to managing, controlling, and documenting changes to an information system or its environment of operation is an essential element of an effective monitoring program. Strict configuration management and control processes are established by the agency to support such monitoring activities.

Security Impact Analysis (SIA) determines the extent to which proposed or actual changes to the information system or its environment of operation can affect or have affected the security state of the system. Changes to the information system or its environment of operation may affect the security controls currently in place, produce new vulnerabilities in the system, or generate requirements for new security controls that were not needed previously. If the results of the SIA indicate that the proposed or actual changes can affect or have affected the security state of the system, corrective actions are initiated and appropriate documents are revised and updated.

In 2007, OMB published M-08-05 announcing the Trusted Internet Connections (TIC) initiative. At the time, there was no uniformity or policy around the gateways used by federal networks to connect to the internet. As a result, federal agency internet connections were inconsistent, insecure, and insufficient in the face of increasing risks of vulnerability exploitation and data exfiltration.

To address these concerns, the TIC initiative sought to improve the security of connections between internal federal agency networks and the internet. The initiative’s goal was to reduce the number of these connections to 50 or less, in order to permit centralized monitoring and security of all traffic between federal networks and the public internet.

All traffic between federally controlled networks and the internet must pass through a Trusted Internet Connection. This is a requirement for any ATO process; no information system or web application intended for use by the federal government will be granted an ATO unless its traffic is routed through a TIC.

An ATO is valid for three years, based on the assumption that the system’s security posture won’t change significantly during that time period. This assumption that significant changes won’t occur may be unrealistic because of agile software development practices, which facilitate and embrace change. As significant changes are inevitably made, the ATO becomes insufficient, resulting in a need to reassess and reauthorize the system. The RMF offers a structured process to integrate information security and risk management activities into the system development life cycle.

This is a glossary of important terms to understand in relation to the ATO process.

ACT

See Adaptive Capabilities Testing below.

Adaptive Capabilities Testing (ACT)

An agency-specific next generation assessment based on NISTIR 8011, relying heavily on automation and focusing on capabilities rather than individual controls.

AO

See Authorizing Official below.

Authorization Boundary

All components of an information system to be authorized for operation by an authorizing official. This excludes separately authorized systems to which the information system is connected. NIST glossary entry for Authorization Boundary.

Authorizing Official (AO)

A senior (federal) official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the nation. NIST glossary entry for Authorizing Official.

EINSTEIN

The federal government’s intrusion detection and response system. All network traffic passing through a TIC is routed through EINSTEIN in order to protect federal networks from malicious traffic and attacks. Additionally, all traffic passing through EINSTEIN is analyzed for persistent long-term threat patterns. CISA reference for EINSTEIN.

Federal Information Security Modernization Act (FISMA)

FISMA 2014 codifies the Department of Homeland Security’s role in administering the implementation of information security policies for federal executive branch civilian agencies, overseeing agencies’ compliance with those policies, and assisting OMB in developing those policies. CISA reference for FISMA.

Federal Information Processing Standards (FIPS)

Standards created by NIST that federal information systems are required to follow. These include the standards for cryptographic algorithms and the minimum security controls required by federal information systems. Current FIPS Standards.

Federal Risk and Authorization Management Program (FedRAMP)

A U.S. government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. All cloud services used by federal information systems must be FedRAMP-approved in order to be granted an ATO. FedRAMP website.

FedRAMP

See Federal Risk and Authorization Management Program above.

FIPS

See Federal Information Processing Standards above.

FIPS 199

Standards for Security Categorization of Federal Information and Information Systems. This publication establishes the definitions of the security categorization: Low, Moderate, and High. Each security categorization requires a different level of documentation and security. FIPS publication 199.

FIPS 200

Minimum Security Requirements for Federal Information and Information Systems. Provides an overview of the security controls required to secure and authorize federal information systems. FIPS publication 200.

FISMA

See Federal Information Security Modernization Act above.

Information System Security Officer (ISSO).

Individual assigned responsibility by the senior agency information security officer, authorizing official, management official, or information system owner for ensuring that the appropriate operational security posture is maintained for an information system or program. NIST glossary entry for ISSO.

Interconnection Security Agreement (ISA)

A document that regulates security-relevant aspects of an intended connection between an agency and an external system. It regulates the security interface between any two systems operating under two different distinct authorities. It includes a variety of descriptive, technical, procedural, and planning information. It is usually preceded by a formal MOA/MOU that defines high-level roles and responsibilities in management of a cross-domain connection. NIST glossary entry for ISA.

ISA

See Interconnection Security Agreement above.

ISSO

See Information System Security Officer above.

Memorandum of Understanding or Agreement (MOU/MOA)

A document established between two or more parties to define their respective responsibilities in accomplishing a particular goal or mission. In this guide, an MOU/A defines the responsibilities of two or more organizations in establishing, operating, and securing a system interconnection. NIST Glossary entry for MOU/MOA.

MOA

See Memorandum of Understanding or Agreement above.

MOU

See Memorandum of Understanding or Agreement above.

National Institute of Standards and Technology (NIST)

Article 1, section 8, of the Constitutionof the United States (1789) requires Congress to “fix the standard of weights and measures." NIST is the non-regulatory agency in the Department of Commerce that determines those standards, including everything from the official U.S. definition of inches and pounds to the definition of time itself. Their complete dominion over how we quantify the universe itself includes setting the standards for information technology security that U.S. federal agency information systems are required to follow in order to attain their ATO. NIST website.

NIST

See National Institute of Standards and Technology above.

NIST SP 800-37

The document that defines the Risk Management Framework for Information Systems and Organizations. This document lays out the NIST standards for evaluating and managing the risks inherent in operating information systems. It is considered authoritative by most federal agencies in their ATO determinations and lays out the basic evaluation process followed by most agencies in preparing their Authorization Package. The current revision of this is NIST 800-37 Revision 2.

NIST SP 800-53

The definition of Security and Privacy Controls for Federal Information Systems and Organizations. It consists of hundreds of specific security controls that must be addressed before a federal information system can be considered secure. The current revision of this standard is NIST 800-53 Revision 5. A companion volume, NIST 800-53Ar4, provides guidance on assessing the security of federal information systems.

Office of Management and Budget (OMB)

OMB is the office within the Executive Office of the President of the United States that produces the president's budget and ensures federal agency compliance with the president's programs, policies, and procedures. It is also responsible for creating initiatives across executive branch agencies. The OMB director reports to the president, vice president, and the White House chief of staff.

OMB

See Office of Management and Budget above.

OMB M-19-26

2019 OMB Memorandum outlining TIC use cases for newer technologies such as cloud services. OMB M-19-26 full memo.

OMB M-08-05

Implementation of Trusted Internet Connections (TIC). The memo that outlined the initiative to require all traffic between federal networks and the internet to pass through a TIC. OMB M-08-05 full memo.

OMB M-03-22

OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. This memorandum established the need for Privacy Impact Analysis (PIA) of federal information systems. OMB M-03-22 full memo.

PIA

See Privacy Impact Assessment below.

Plan of Action and Milestones (POA&M or POAM)

A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones. NIST glossary entry for POAM.

POAM

See Plan of Action and Milestones above.

Privacy Impact Assessment (PIA)

A process for examining the risks and ramifications of collecting, maintaining, and disseminating information in identifiable form in an electronic information system. It's also a process for identifying and evaluating protections and alternative processes to mitigate the impact to privacy of collecting information in identifiable form. Consistent with the September 26, 2003, OMB guidance (M-03-22) implementing the privacy provisions of the E-Government Act, agencies must conduct privacy impact assessments for all new or significantly altered IT investments administering information in identifiable form collected from or about members of the public. Agencies may choose whether to conduct privacy impact assessments for IT investments administering information in identifiable form collected from or about agency employees. The PIA plays a vital role in the ATO process by justifying the potential impact of a compromise of the information system. NIST glossary entry for PIA.

Privacy Threshold Assessment (PTA)

A process for determining whether an information system contains Personally Identifiable Information (PII) and therefore requires a PIA.

PTA

See Privacy Threshold Assessment above.

Risk Assessment

The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the nation resulting from the operation of an information system. Part of risk management, it incorporates threat and vulnerability analyses and considers mitigations provided by security controls planned or in place. Synonymous with risk analysis. NIST glossary entry for risk assessment.

Security impact analysis (SIA)

The analysis conducted by an organizational official to determine the extent to which changes to the information system have affected the security state of the system. NIST glossary entry for SIA.

SCA

See Security Controls Assessment below.

Security Controls Assessment (SCA)

The testing and/or evaluation of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. NIST glossary entry for SCA.

SIA

See Security Impact analysis above.

Trusted Internet Connections (TIC)

Internet gateways for federal networks monitored and supervised by the Department of Homeland Security in accordance with M-08-05 and subsequent guidance. It is an ATO requirement that all traffic entering or exiting from federal networks must transit through a TIC. CISA reference for TIC.

TIC

See Trusted Internet Connections above.

These are links to resources with further information about the ATO process.

NIST publications and references

NIST 800-37 Revision 2 - Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

NIST 800-53 Revision 5 - Assessing Security and Privacy Controls in Federal Information Systems and Organizations

NIST 800-53Ar4 - Security and Privacy Controls for Federal Information Systems and Organizations

NIST Glossary

Other government guidance

Taking the ATO process from 6 months to 30 days [18F]

To get things done, you need great, secure tools [18F]

Cloud.gov ATO Process

FedRAMP

Federal Information Security Modernization Act (FISMA)

Trusted Internet Connections [CISA]

Unofficial guidance

OpenControl's Introduction to ATOs

Navigating the US Federal Government Agency ATO Process for IT Security Professionals [ISACA]

Understanding Authority to Operate: FISMA or FedRAMP? [GovDataHosting]

What's Happening with the Trusted Internet Connection? [GovInfoSecurity]