A plain-words guide to Authorization to Operate

ATO Evidence

Latest / Story

Who Signs an ATO?

ATO Evidence · October 07, 2026

Teams often finish months of security work and then learn only one person can authorize the system to operate.

The short answer

The signature belongs to the Authorizing Official (AO). An ATO is an Authorization to Operate. It is a formal decision to let a system operate NIST SP 800-37 Rev 2. The AO accepts the system's residual risk NIST SP 800-37 Rev 2. The Risk Management Framework (RMF) standard assigns this decision to the AO NIST SP 800-37 Rev 2. NIST is the National Institute of Standards and Technology. Risk acceptance by the AO is explicit. It cannot be delegated to another official NIST SP 800-37 Rev 2. Understanding the role prevents weeks of delay at the final signature step.

What authority the AO carries

The AO is a senior executive with authority over the system NIST SP 800-53 Rev 5. The AO assumes responsibility for operating at an acceptable level of risk NIST SP 800-37 Rev 2. AOs typically oversee the system's budget or mission operations NIST SP 800-37 Rev 2. This is why the AO is a senior official, not a technical contributor NIST SP 800-37 Rev 2. Only the AO can issue or deny an ATO NIST SP 800-37 Rev 2. The AO can halt an operating system when risk becomes unacceptable NIST SP 800-37 Rev 2. Control CA-6, Authorization, requires naming a senior official as AO NIST SP 800-53 Rev 5. It requires the AO to authorize the system before operations begin NIST SP 800-53 Rev 5.

How the AO differs from the other roles

The AO differs from three other RMF roles. The System Owner builds the system and assembles the authorization package NIST SP 800-37 Rev 2. The Information System Security Officer (ISSO) advises on daily security operations NIST SP 800-37 Rev 2. The ISSO does not sign the authorization decision NIST SP 800-37 Rev 2. The Security Control Assessor tests controls and reports findings NIST SP 800-37 Rev 2. Only the AO decides whether the resulting risk is acceptable NIST SP 800-37 Rev 2. An Authorizing Official Designated Representative can support the process NIST SP 800-37 Rev 2. Explicit risk acceptance never leaves the AO NIST SP 800-37 Rev 2.

What the AO reviews and signs

Assessment results come first, then the package is assembled NIST SP 800-37 Rev 2. Only then does the AO decide NIST SP 800-37 Rev 2. The AO reviews the authorization package and input from other officials NIST SP 800-37 Rev 2. The AO considers the risk assessment and planned responses to risks NIST SP 800-37 Rev 2. The decision weighs security against mission needs NIST SP 800-37 Rev 2. The standard package holds four parts NIST SP 800-37 Rev 2:

  1. Executive summary of the system's security and privacy posture
  2. System Security Plan (SSP) describing the controls in place
  3. Security Assessment Report (SAR) with assessor findings
  4. Plan of Action and Milestones (POA&M) for open weaknesses

The System Owner assembles the package, so the AO never starts from blank paper NIST SP 800-37 Rev 2. The SAR shows how the assessment turned out NIST SP 800-37 Rev 2. The AO weighs those results against mission needs before deciding NIST SP 800-37 Rev 2. The decision may grant or deny an Authorization to Operate NIST SP 800-37 Rev 2. It may also grant an Authorization to Use or a common control authorization NIST SP 800-37 Rev 2. The decision is conveyed through an authorization decision document NIST SP 800-53 Rev 5.

What ongoing authorization means for the signature

An ATO is not permanent by default. The signature stays valid only while risk stays acceptable NIST SP 800-37 Rev 2. Under ongoing authorization, the AO reviews the system's posture continuously NIST SP 800-37 Rev 2. The goal is to decide whether risk remains acceptable NIST SP 800-37 Rev 2. Findings from continuous monitoring feed updates to the SSP, SAR, and POA&M NIST SP 800-37 Rev 2. Assessment frequency follows the organization's monitoring strategy NIST SP 800-37 Rev 2. Time or event driven triggers can prompt the AO to review posture again NIST SP 800-37 Rev 2. If risk is no longer acceptable, the AO can deny the ATO NIST SP 800-37 Rev 2. The AO can then direct corrective action NIST SP 800-37 Rev 2.

Practical next steps

  1. Confirm who holds the AO role and document the assignment NIST SP 800-53 Rev 5
  2. Assemble the package before approaching the AO: SSP, SAR, POA&M, executive summary
  3. Map SAR findings to POA&M items with owners and dates
  4. Set a monitoring rhythm for posture updates between authorizations NIST SP 800-37 Rev 2
  5. Flag significant changes early; they can trigger reauthorization NIST SP 800-37 Rev 2
  6. Record the decision and its risk basis in the authorization decision document

PolicyCortex provides SSP, SAR, and POA&M output produced from collected evidence; see policycortex.com.

Sources

  • NIST SP 800-37 Rev 2, Risk Management Framework for Information Systems and Organizations: https://doi.org/10.6028/NIST.SP.800-37r2
  • NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations, including control CA-6 (Authorization): https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final