Differences

This shows you the differences between two versions of the page.

--- public:99_annexes:annex-b-terms-and-definitions:a:ato [2026/09/12 17:42] – ↷ Page moved from private:99_annexes:annex-b-terms-and-definitions:a:ato to public:99_annexes:annex-b-terms-and-definitions:a:ato nick_dido
+++ public:99_annexes:annex-b-terms-and-definitions:a:ato [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
@@ Line 1: / Line 1: @@
 ====== Authorization to Operate (ATO) ======
-[[private:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
+[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
 ===== Discussion =====
-An Authorization to Operate (ATO) records a risk-based management decision by an [[private:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority|Authorizing Authority]] to permit a system to operate within a defined [[private:99_annexes:annex-b-terms-and-definitions:a:accreditation_boundary|Accreditation Boundary]], operational environment, scope, and period.
+An Authorization to Operate (ATO) records a risk-based management decision by an [[public:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority|Authorizing Authority]] to permit a system to operate within a defined [[public:99_annexes:annex-b-terms-and-definitions:a:accreditation_boundary|Accreditation Boundary]], operational environment, scope, and period.
-The Authorizing Authority bases the decision on the system’s security and privacy posture, assessment results, identified risks, implemented controls, mission or business requirements, and supporting [[private:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]].
+The Authorizing Authority bases the decision on the system’s security and privacy posture, assessment results, identified risks, implemented controls, mission or business requirements, and supporting [[public:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]].
 An ATO explicitly assigns responsibility for accepting the residual risk associated with operating the system. The authorization may include conditions, limitations, monitoring obligations, expiration criteria, or requirements for corrective action.
-Crucible does not issue an ATO. Crucible produces controlled artifacts, assessment results, [[private:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]], [[private:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]], and compliance evidence that may support an Authorizing Authority’s decision.
+Crucible does not issue an ATO. Crucible produces controlled artifacts, assessment results, [[public:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]], [[public:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]], and compliance evidence that may support an Authorizing Authority’s decision.
 ===== Definition =====
@@ Line 27: / Line 27: @@
 An ATO does not establish that the system is free from risk. It establishes that the responsible Authorizing Authority accepts the identified residual risk under the stated conditions.
-An ATO differs from [[private:99_annexes:annex-b-terms-and-definitions:a:accreditation|Accreditation]]. Accreditation formally recognizes that an organization, process, facility, or capability satisfies defined criteria, while an ATO permits a specified system to operate based on an explicit risk decision.
+An ATO differs from [[public:99_annexes:annex-b-terms-and-definitions:a:accreditation|Accreditation]]. Accreditation formally recognizes that an organization, process, facility, or capability satisfies defined criteria, while an ATO permits a specified system to operate based on an explicit risk decision.
 ===== Example =====