Written and maintained by CASRAI Editorial Board
Last updated
An authority to operate (ATO) is the decision by which a senior federal official accepts the risk of running an information system and allows it to operate. This guide covers the US federal meaning, the one used with the NIST Risk Management Framework, as described in the NIST publications listed under Sources (checked 2026-10-29). The abbreviation ATO is also used for unrelated things, such as the FAA’s Air Traffic Organization, and general permits to operate in non-IT settings; none of those are covered here.
What an authority to operate is
An ATO is an official management decision, given by a senior federal official or officials, to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation, based on the implementation of an agreed-upon set of security and privacy controls. That is the wording of the NIST Computer Security Resource Center (CSRC) glossary entry for authorization to operate.
Two points from that entry are easy to miss. First, the system is authorized to operate for a set period of time, on terms and conditions the authorizing official sets. Second, “authorization” is the NIST term; the glossary notes that it was formerly known as “approval to operate” and that the term was replaced in the risk management framework. “Authority to operate” is the common variant that people search for, and it refers to the same decision. The decision is a step in the Risk Management Framework described in FISMA compliance, not a standalone certificate.
Where the ATO sits in the Risk Management Framework
According to the abstract of SP 800-37 Rev. 2, the Risk Management Framework covers security categorization, control selection, control implementation and assessment, system and common control authorizations, and continuous monitoring. The ATO therefore comes after controls have been selected, implemented and assessed, and before the Monitor step. This ordering is why a package full of assessment results is the entry ticket to the decision, and why a system cannot sensibly be authorized before the earlier steps have produced evidence. It is also why the monitoring that follows matters: it is what can later support an ongoing authorization.
Who grants an ATO
The decision belongs to the authorizing official. In NIST SP 800-37 Rev. 2 (December 2018), the authorizing official has primary responsibility for the authorization decision (task R-4 also names an authorizing official designated representative), and the explicit acceptance of risk is the responsibility of the authorizing official and cannot be delegated to other officials within the organization. Before the final decision, the authorizing official consults the Senior Accountable Official for Risk Management or the Risk Executive (Function).
The authorizing official does not assemble the evidence. The system owner, the common control provider and the Senior Agency Official for Privacy are the roles responsible for assembling and submitting the authorization package. For a research institution or a vendor, this split matters: you can supply and maintain the package contents, but the risk acceptance itself sits with the agency official. If you are asking an agency for an ATO, the useful question is therefore who the authorizing official is and what that official expects to see in the package, not whether a vendor-side document can stand in for the decision.
What the authorization package contains
SP 800-37 Rev. 2 task R-1 says to assemble the authorization package and submit it to the authorizing official for a decision. The inputs it lists are:
- the security and privacy plans;
- the security and privacy assessment reports;
- the plan of action and milestones; and
- supporting assessment evidence.
The output is the authorization package, with an executive summary. The controls that the plans and assessments describe are drawn from the control catalogue in NIST SP 800-53 Rev. 5, which NIST cites alongside SP 800-37 as a source of the ATO definition.
The five tasks of the Authorize step
SP 800-37 Rev. 2 organises the Risk Management Framework into seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. An ATO is produced in the Authorize step, which has five tasks (Table 7 of the publication).
| Task | Name | What the publication says it does |
|---|---|---|
| R-1 | Authorization Package | Assemble the package and submit it to the authorizing official for a decision (system owner, common control provider and Senior Agency Official for Privacy are responsible). |
| R-2 | Risk Analysis and Determination | Analyze and determine the risk from the operation or use of the system or the provision of common controls. The output is a risk determination; NIST SP 800-30 is the related risk assessment guide. |
| R-3 | Risk Response | Identify and implement a preferred course of action in response to the risk determined. The output is risk responses for the determined risks. |
| R-4 | Authorization Decision | The authorizing official (or designated representative) has primary responsibility for the task, though risk acceptance itself cannot be delegated; the outputs are the six decisions listed below. |
| R-5 | Authorization Reporting | Report the decision and annotate the authorization status in the organizational system registry. |
Decision outcomes, termination dates and ongoing authorization
Task R-4 lists six possible outputs: authorization to operate, authorization to use, common control authorization, and the denial of each of the three. An ATO is therefore one outcome of a decision that can also be a denial. The decision conveys the terms and conditions of the authorization, together with either the authorization termination date or a time-driven authorization frequency.
The authorization termination date is set by the authorizing official and indicates when the authorization expires. SP 800-37 Rev. 2 says organizations may eliminate the termination date if the system is operating under an ongoing authorization, which requires that continuous monitoring is sufficiently robust and mature. Under ongoing authorization, the authorization frequency is specified in place of a termination date. So an ATO does expire unless it is replaced by an ongoing authorization arrangement.
Common mistakes
- Treating risk acceptance as something a vendor, system owner or delegate can sign. The publication states it cannot be delegated to other officials within the organization.
- Treating the ATO as permanent. The decision carries either a termination date or an authorization frequency under ongoing authorization.
- Confusing the package with the decision. The package (R-1) is evidence submitted to the authorizing official; the ATO is the later decision (R-4).
- Assuming “authority to operate” is the formal NIST term. NIST’s term is authorization to operate, formerly approval to operate.
- Skipping the registry update. R-5 includes annotating the authorization status in the organizational system registry.
Related programs and publications
| Related page | How it connects to an ATO |
|---|---|
| NIST SP 800-53 Rev. 5 | One of the publications NIST cites as a source of the ATO definition; it is the control catalogue behind the “agreed-upon set of security and privacy controls”. |
| FIPS 199 | Security categorization, which belongs to the Categorize step that comes before Authorize in the framework. |
| NIST SP 800-30 | Risk assessment guidance relevant to the risk analysis in task R-2. |
| FedRAMP High | Its Agency Authorization path has a cloud service provider work directly with a federal agency to pursue an ATO, as the FedRAMP High guide on this site describes. |
Frequently asked questions
What does authority to operate mean?
It is a senior federal official’s formal decision to let an information system operate and to accept the associated risk, based on an agreed set of security and privacy controls. NIST’s own term is authorization to operate.
Who issues an ATO?
The authorizing official. The risk acceptance cannot be delegated to other officials in the organization.
Does an ATO expire?
It can. The authorizing official sets an authorization termination date, unless the system is under ongoing authorization, in which case an authorization frequency is specified instead.
Is an ATO the same as FedRAMP?
No. An ATO is the RMF decision itself. FedRAMP’s Agency Authorization path involves a cloud service provider pursuing an ATO with a federal agency; see the FedRAMP High guide.
Sources
- NIST CSRC Glossary, “authorization to operate”: https://csrc.nist.gov/glossary/term/authorization_to_operate (checked 2026-10-29).
- NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018: https://csrc.nist.gov/pubs/sp/800/37/r2/final (checked 2026-10-29). Full text: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf.
- FedRAMP High guide on this site: /guides/fedramp-high (checked 2026-10-29).
