What is an ATO?

An authorization to operate (ATO) is the official management decision by a senior federal official to authorize operation of an information system and to explicitly accept the risk to agency operations, agency assets, individuals, other organizations, and the Nation. That wording, in the National Institute of Standards and Technology (NIST) glossary, comes from the 2022 Committee on National Security Systems glossary (CNSSI 4009-2022) and Office of Management and Budget (OMB) Circular A-130. The decision is the Authorize step of the Risk Management Framework (RMF) in NIST Special Publication (SP) 800-37 Revision 2, published December 2018. For the Department of Defense (DoD), DoD Instruction (DoDI) 8510.01, effective July 19, 2022, sets the RMF for DoD systems.

Who makes the decision

The glossary entry adds two notes. The system is authorized for a specified period under terms and conditions the authorizing official sets, and the term replaced "approval to operate" in the RMF in 2010. The authorizing official (AO) is a senior federal official or executive with the authority to assume responsibility for operating a system, or for using a set of common controls, at an acceptable level of risk. The role was formerly called the accrediting official, accrediting authority, or designated accrediting authority.

The full text of SP 800-37 lets the AO hand most RMF work to a designated representative. The only activity that cannot be delegated is the authorization decision and the signing of the decision document, which is the acceptance of risk.

DoDI 8510.01 adds DoD rules. Component heads appoint an AO for every system operating within or on behalf of the Component. AOs must be government personnel only, must have expertise with the technology, and must complete AO training or an RMF course offered by NIST. An AO may downgrade or revoke an authorization at any time if risk conditions warrant.

Federal law uses the same term. The definitions for the Federal Risk and Authorization Management Program (FedRAMP), at 44 U.S.C. 3607, added by Public Law 117-263 on December 23, 2022, give "authorization to operate" the meaning in OMB Circular A-130.

Seven steps, one decision

SP 800-37 Revision 2 has seven steps, a preparatory step and six main steps: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. Assess checks whether controls are implemented correctly, operating as intended, and producing the desired outcomes. Authorize rests on a determination that the risk is acceptable. Monitor runs on an ongoing basis.

DoDI 8510.01 uses the same seven step names and states that, in accordance with Executive Order 13800, NIST publications are the authoritative guidelines for the DoD RMF. The instruction's Authorize step has five tasks: the authorization package, risk analysis and determination, risk response, the authorization decision, and authorization reporting. The DoD package consists of the security plan, the security assessment report, all plans of action and milestones (POA&Ms), and the authorization decision document.

Four decisions in NIST, four labels in DoD

Appendix F of SP 800-37 lists four types of decision:

• Authorization to operate. Issued when the AO finds the risk acceptable. The AO sets an authorization termination date as a condition and can adjust it at any time.
• Common control authorization. A similar decision for common controls that systems inherit.
• Authorization to use. A customer organization accepts another organization's package as a form of reciprocity, only after another federal entity has issued a valid ATO.
• Denial of authorization. The risk is unacceptable and cannot be reduced right away. If the system is operating, all activity is halted.

DoDI 8510.01 gives a different set of examples: interim authorization to test, ATO, ATO with conditions, and denial ATO. The instruction does not define them in its own text. It says the definitions and examples are on the RMF Knowledge Service.

Interim authorizations

CNSSI 4009-2022, quoted in the NIST glossary, defines an interim authorization to test (IATT) as a temporary authorization to test an information system in a specified operational environment, within the timeframe and under the conditions in the written authorization.

SP 800-37 Revision 2 covers the same need without a separate decision type. An AO may authorize a system to operate only for a short period when it must be tested in the operational environment before all controls are fully in place, limited to the time the testing needs. A footnote says this was formerly referred to as an interim authority to test. The AO may add restrictions such as a minimum number of users, limited time periods, increased audit logging and monitoring, or only the functions that need live testing.

NIST therefore treats the test period as a short, restricted ATO, while DoDI 8510.01 keeps IATT as a named decision.

Continuous monitoring and ongoing authorization

SP 800-37 defines ongoing authorization as the follow-on risk determinations and risk acceptance decisions taken at agreed-upon, documented frequencies. The process can be time-driven or event-driven. An organization may eliminate the authorization termination date when the system operates under ongoing authorization, meaning the continuous monitoring program gives the AO the information needed for ongoing risk decisions. The AO then reviews the system at a set authorization frequency instead of a termination date, and remains responsible for accepting the risk.

The publication's abstract says the RMF promotes near real-time risk management and ongoing authorization through continuous monitoring. DoDI 8510.01 places this in the Monitor step. Task M-2 calls for ongoing assessments of control effectiveness under the continuous monitoring strategy, and Task M-6 says AOs conduct ongoing authorizations using the results of continuous monitoring and communicate changes in risk determination and acceptance decisions.

What to check

• Who signed the decision? Only the AO may make it, and in DoD the AO must be government personnel.
• Which decision is it: ATO, ATO with conditions, IATT, authorization to use, or denial, and what conditions does it carry?
• What is the authorization termination date or, under ongoing authorization, the review frequency?
• Does the package hold the security plan, the security assessment report, all POA&Ms, and the decision document?
• For an IATT, what timeframe, environment, and restrictions does the written authorization set?
• When a system relies on another organization's ATO, has the customer's AO issued an authorization to use?

Azcuna's ELLMENT, the E-2D Large Language Model Entity, was proposed to NAVAIR PMA-231 under Navy SBIR Phase I topic DON26BZ01-NV010. The prototype, built at private expense on publicly available doctrine, answers with a page-level citation and refuses when the documents do not support an answer. The proposal has been submitted.

Sources

1. 1SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy · NIST Computer Security Resource Center, December 2018
2. 2NIST SP 800-37, Revision 2 (full text) · National Institute of Standards and Technology, December 2018
3. 3authorization to operate (glossary entry) · National Institute of Standards and Technology
4. 4authorizing official (glossary entry) · National Institute of Standards and Technology
5. 5interim authorization to test (glossary entry) · National Institute of Standards and Technology, from CNSSI 4009-2022
6. 6DoD Instruction 8510.01, Risk Management Framework for DoD Systems, July 19, 2022 · Office of the DoD Chief Information Officer (Directives Division copy, archived October 12, 2026)
7. 7United States Code, 2024 Edition, Title 44, Section 3607 - Definitions · U.S. Government Publishing Office

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.