All articles
ATO / RMF
The ATO package, explained without the acronyms
, 8 min read
SSP, SAR and POA&M are the three documents every federal system lives by. Here's what each one is for and who reads it.
An Authority to Operate is a formal decision that a system's risk is acceptable. The decision is made by an Authorizing Official, and it rests on a small set of documents.
The System Security Plan describes the system and how each control is implemented. The Security Assessment Report records what the assessor tested and found. The Plan of Action and Milestones lists every weakness that is still open, with an owner and a date.
Most of the day-to-day work is keeping those three documents consistent with each other and with reality. When they drift apart, assessments take longer and findings pile up.
