public:99_annexes:annex-b-terms-and-definitions:a:ato

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
public:99_annexes:annex-b-terms-and-definitions:a:ato [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1public:99_annexes:annex-b-terms-and-definitions:a:ato [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
Line 1: Line 1:
 +====== Authorization to Operate (ATO) ======
  
 +[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
 +
 +===== Discussion =====
 +
 +An Authorization to Operate (ATO) records a risk-based management decision by an [[public:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority|Authorizing Authority]] to permit a system to operate within a defined [[public:99_annexes:annex-b-terms-and-definitions:a:accreditation_boundary|Accreditation Boundary]], operational environment, scope, and period.
 +
 +The Authorizing Authority bases the decision on the system’s security and privacy posture, assessment results, identified risks, implemented controls, mission or business requirements, and supporting [[public:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]].
 +
 +An ATO explicitly assigns responsibility for accepting the residual risk associated with operating the system. The authorization may include conditions, limitations, monitoring obligations, expiration criteria, or requirements for corrective action.
 +
 +Crucible does not issue an ATO. Crucible produces controlled artifacts, assessment results, [[public:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]], [[public:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]], and compliance evidence that may support an Authorizing Authority’s decision.
 +
 +===== Definition =====
 +
 +//risk-based management decision by an authorizing authority that permits operation of a system within a defined scope and explicitly accepts the associated residual risk//
 +
 +===== Source =====
 +
 +Adapted from the National Institute of Standards and Technology Risk Management Framework and NIST Special Publication 800-37 Revision 2.
 +
 +===== Note =====
 +
 +An ATO applies only to the system, authorization boundary, operating conditions, environment, and period identified by the authorization decision.
 +
 +An ATO does not establish that the system is free from risk. It establishes that the responsible Authorizing Authority accepts the identified residual risk under the stated conditions.
 +
 +An ATO differs from [[public:99_annexes:annex-b-terms-and-definitions:a:accreditation|Accreditation]]. Accreditation formally recognizes that an organization, process, facility, or capability satisfies defined criteria, while an ATO permits a specified system to operate based on an explicit risk decision.
 +
 +===== Example =====
 +
 +An Authorizing Authority reviews the security assessment report, compliance findings, remediation status, system security plan, risk assessment, and supporting evidence for a deployed Crucible environment. The Authorizing Authority issues an ATO that permits the environment to operate for a defined period subject to continuous monitoring and specified corrective actions.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>