Authorization to Operate (ATO)

Go up to Terms and Definitions

An Authorization to Operate (ATO) records a risk-based management decision by an Authorizing Authority to permit a system to operate within a defined Accreditation Boundary, operational environment, scope, and period.

The Authorizing Authority bases the decision on the system’s security and privacy posture, assessment results, identified risks, implemented controls, mission or business requirements, and supporting Evidence.

An ATO explicitly assigns responsibility for accepting the residual risk associated with operating the system. The authorization may include conditions, limitations, monitoring obligations, expiration criteria, or requirements for corrective action.

Crucible does not issue an ATO. Crucible produces controlled artifacts, assessment results, Provenance, Traceability, and compliance evidence that may support an Authorizing Authority’s decision.

risk-based management decision by an authorizing authority that permits operation of a system within a defined scope and explicitly accepts the associated residual risk

Adapted from the National Institute of Standards and Technology Risk Management Framework and NIST Special Publication 800-37 Revision 2.

An ATO applies only to the system, authorization boundary, operating conditions, environment, and period identified by the authorization decision.

An ATO does not establish that the system is free from risk. It establishes that the responsible Authorizing Authority accepts the identified residual risk under the stated conditions.

An ATO differs from Accreditation. Accreditation formally recognizes that an organization, process, facility, or capability satisfies defined criteria, while an ATO permits a specified system to operate based on an explicit risk decision.

An Authorizing Authority reviews the security assessment report, compliance findings, remediation status, system security plan, risk assessment, and supporting evidence for a deployed Crucible environment. The Authorizing Authority issues an ATO that permits the environment to operate for a defined period subject to continuous monitoring and specified corrective actions.