TL;DR: Authority to Operate (ATO) Examples
An Authority to Operate (ATO) authorizes the deployment of a software solution that meets both specific operational needs and prescribed cybersecurity requirements. However, traditional ATOs lack speed and adequate security to address technology changes and emerging threats. The waiting period for an ATO and associated assessments hamper the swift deployment of critical software capabilities. A popular alternative involves moving to an ongoing authorization tailored for continuous delivery, commonly called continuous Authority to Operate (cATO).
Rise8 is at the forefront of implementing cATO, leveraging the principles of the Risk Management Framework, Agile, and DevOps to streamline the authorization process, making it faster and more efficient while maintaining rigorous security standards. To ensure your organization can achieve continuous compliance and operational excellence, Rise8 is dedicated to providing resources like an Authorization to Operate checklist or our cATO playbook—to help you continuously deliver high-quality software with reduced risk. In this article, we'll explore a real-world example of an ATO to illustrate the comprehensive process and explore cATO.
What Is an Example of Authority To Operate?
A practical ATO example is a U.S. Army system that must complete the NIST Risk Management Framework (RMF) and receive risk acceptance from an Authorizing Official (AO) before it can operate on the Army network.
The Problem With Traditional ATO
The DoD ATO example illustrates the basic RMF process, but the traditional approach can take several months to over a year in practice and may delay the deployment of critical systems.
Here are common drawbacks agencies face with the traditional ATO model:
- Time-Intensive: Traditional ATOs can delay mission‑critical deployments or major updates by months or longer.
- Resource-Heavy: The process requires substantial personnel and documentation, creating barriers for smaller projects.
- Static in Nature: ATOs are based on point‑in‑time assessments, which can’t keep up with fast‑evolving threats without strong continuous monitoring.
- Operational Delays: Significant changes or updates may require reassessment or reauthorization, slowing responsiveness and readiness.
What is Continuous Authority to Operate (cATO)?
With these challenges in mind, DoD programs are shifting to Continuous Authority to Operate (cATO).
Continuous ATO (cATO) is an RMF‑based, ongoing authorization model for continuous delivery after an initial ATO. Instead of waiting for periodic reauthorization, cATO uses continuous monitoring and near real‑time risk decisions to keep systems secure and compliant as they evolve—unless risk thresholds are exceeded and the cATO is revoked.
Ready to continuously deliver valuable software your users will love? Partner with Rise8
With cATO, organizations can achieve continuous compliance and operational excellence, ensuring that their systems are always secure, up-to-date, and ready to move at the speed their users demand. Visit our About page to learn more about Rise8 or schedule a call to see how we can work together to ensure a future where fewer bad things happen because of bad software.
