Continuous ATO (cATO), explained

A continuous authorization to operate (cATO) is a Department of Defense (DoD) status for an authorized system whose risk is monitored in real or near real time, which changes the requirements for reauthorizing its ATO. The policy comes from a memorandum titled Continuous Authorization To Operate (cATO), signed February 2, 2022 by David W. McKeown, the DoD Senior Information Security Officer. The memo says DoD's Risk Management Framework (RMF) practice focused on obtaining authorizations to operate (ATOs) but fell short on continuous monitoring after authorization. It names three competencies the authorizing official (AO) must demonstrate.

The three competencies

The memo lists them in one sentence: ongoing visibility of key cybersecurity activities inside the system boundary, with continuous monitoring of RMF controls; the ability to conduct active cyber defense against threats in real time; and adoption of an approved DevSecOps reference design. DevSecOps joins development, security, and operations, which the memo says have traditionally been separate disciplines.

Continuous monitoring (CONMON). Every system needs a monitoring strategy covering all controls in its security baseline, including common controls. Automated monitoring should be as near real time as feasible, and manual controls must still be in the plan. For cATO, all security controls feed a system-level dashboard the AO can watch.

Active cyber defense. The memo states that conducting scans and patching "does not meet the threshold." A system must show it can deploy countermeasures in real or near real time. AOs must stay in constant contact with cyber operational components, among them cybersecurity service providers, component cyber operations forces, and U.S. Cyber Command.

Secure software supply chain. The memo ties the third competency to software built in a controlled environment. An approved software platform and pipeline help prevent human error, supply chain interdiction, and unintended code, and support a software bill of materials (SBOM).

How a cATO is granted and lost

The AO notifies the component chief information security officer (CISO). The two then present the request and its evidence to the DoD CISO. A cATO approved by the DoD CISO has no expiration date and stays in effect while the real-time risk posture holds. The memo stresses that the cATO does not affect the underlying system ATO. It changes the requirements for reauthorizing that ATO.

A cATO can be revoked for poor cybersecurity posture found by monitoring or external assessment, for changes in risk tolerance, or after an incident caused by poor practice. A system can lose cATO temporarily and keep its ATO.

The idea builds on what the National Institute of Standards and Technology (NIST) calls ongoing authorization. NIST SP 800-37 Revision 2, December 2018, lets an organization drop the authorization termination date when continuous monitoring is mature enough, and has the AO review at a set frequency instead. The AO stays accountable for accepting the risk.

The DevSecOps reference design

The memo says a cATO system must align to an approved DoD Enterprise DevSecOps Reference Design, and allows new architectures to be submitted for evaluation. One published design is the DoD Enterprise DevSecOps Reference Design for Cloud Native Computing Foundation (CNCF) Kubernetes, version 2.1, September 2021, approved for public release. A reference design describes how a set of technologies forms a secure software factory. This one requires certified Kubernetes in production and can run in a cloud, on premises, in an embedded system, or at the edge. Authorizing officials are among its named readers.

The design stores artifacts in a locally centralized repository tied to the factory. The artifacts come from Iron Bank, which the design calls DoD's repository of digitally signed, hardened container images, which it describes as compliant with Security Technical Implementation Guides (STIGs). A successful build must trigger a container security scan. After deployment, turning the software on typically requires a separate authorization to connect. The cover says the document expires one year from publication unless revised.

Changes in 2025

An April 2025 memo, Accelerating Secure Software, signed by Katherine Arrington as the official performing the duties of the DoD Chief Information Officer and cleared May 2, 2025, said lengthy, outdated authorization processes frustrate continuous delivery. It directed a Software Fast Track (SWFT) Initiative to define cybersecurity and supply chain risk management requirements, software security verification, information sharing, and government-led risk determinations, with a framework due within 90 days.

On September 24, 2025, the Department of War (DoW) announced the Cybersecurity Risk Management Construct (CSRMC). The release says the previous RMF relied too much on static checklists and manual processes, and describes a shift from snapshot assessments to automated, continuous risk management. The construct has five phases and ten tenets, one of them continuous monitoring to achieve a "constant ATO posture." The construct graphic maps the phases to RMF steps: Design to Prepare, Categorize, and Select; Build to Implement; Test to Assess; Onboard to Authorize; and Operations to Monitor, where a system is accepted for continuous monitoring, "enabling cATO."

What to check

• Has the DoD CISO approved the cATO, and which ATO does it modify?
• Does the AO's dashboard show every control in the baseline, including inherited and manual ones?
• What evidence shows active cyber defense beyond scanning and patching?
• Which approved DevSecOps reference design, and which version, does the pipeline follow?
• Where do container images come from, and is each build scanned before release?
• What conditions would cause the cATO to be revoked, and who is watching for them?

Azcuna's ELLMENT, the E-2D Large Language Model Entity, was proposed to NAVAIR PMA-231 under Navy SBIR Phase I topic DON26BZ01-NV010. The prototype, built at private expense on publicly available doctrine, answers with a page-level citation and refuses when the documents do not support an answer. The proposal has been submitted.

Sources

1. 1Continuous Authorization To Operate (cATO), memorandum of February 2, 2022 · DoD Senior Information Security Officer (read from the February 2, 2026 Internet Archive capture)
2. 2DoD Enterprise DevSecOps Reference Design: CNCF Kubernetes, Version 2.1 · DoD Chief Information Officer, September 2021 (read from the February 1, 2026 Internet Archive capture)
3. 3NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations · National Institute of Standards and Technology, December 2018
4. 4Accelerating Secure Software (memorandum) · DoD Chief Information Officer, April 2025, cleared May 2, 2025 (read from the February 2, 2026 Internet Archive capture)
5. 5Department of War Announces New Cybersecurity Risk Management Construct · Department of War Chief Information Officer, September 24, 2025 (read from the June 15, 2026 Internet Archive capture)
6. 6Cyber Security Risk Management Construct (graphic) · Department of Defense Chief Information Officer, cleared September 23, 2025 (read from the October 2, 2026 Internet Archive capture)

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.