Authority to Operate (ATO): the RMF package

If your software runs on a government network or processes government data, an Authorizing Official has to accept the risk — that's the ATO.

ATOs follow the NIST Risk Management Framework (SP 800-37). The DoW runs it in eMASS; each agency has its own instantiation. Expect the process to be owned by your government program office, with you producing the evidence.

1. 1Categorize the system — FIPS 199 impact levels (confidentiality/integrity/availability)
2. 2Select & tailor controls — NIST SP 800-53 baseline for the category
3. 3Implement and document — the SSP — the System Security Plan is the anchor document
4. 4Assess — an independent assessor produces the Security Assessment Report (SAR)
5. 5POA&M the residual gaps — with dates and owners
6. 6Authorize — the AO signs the ATO letter (often 3-year, increasingly continuous)
7. 7Monitor — continuous monitoring keeps the ATO alive