Authorization to operate (ATO) under NIST 800-53

How an authorization to operate under NIST 800-53 is granted

An agency, a contractor or a cloud provider that must show an authorization to operate (ATO) before go-live gets it from one person: the authorizing official (AO). The AO reviews the authorization package, weighs the residual risk to organizational operations, assets and individuals, and then decides whether to grant, deny or conditionally grant the ATO. Under SP 800-37 Rev. 2, that risk acceptance is the AO's alone. The AO may delegate preparation and review to a designated representative, but not the authorization decision or the signature on the decision document. For federal agencies, the AO role is an inherent government function, so a contractor or implementation partner can prepare the package but cannot make or sign the decision.

The package itself is built from the security plan, privacy plan, security assessment report, privacy assessment report and plan of action and milestones. The decision letter sets the terms and conditions, a termination date or time-driven reassessment frequency, and, for common controls, the impact level they support. The system owner acknowledges and implements those terms, so the first practical question for any buyer is whether the expected terms match the planned operating model.

Cost and timeline cannot be read from a published price list. They depend on system scope, the number of controls the system must implement itself versus those it inherits, and how mature the existing evidence is. NIST does not estimate certification or compliance costs and does not set federal implementation timelines, which OMB Circular A-130 addresses. Before requesting a quote, ask the sponsoring agency which authorization path applies, which package templates it expects, and what assessment depth the AO will accept, then confirm those answers in writing with any implementation partner.

What goes into the authorization package

The authorizing official decides on a package, not a single document. SP 800-53A names five parts that together show what the system is, how its controls were tested, what is wrong, and how the remaining gaps will be closed. Each part has a different author, so the AO must see that the owner, the control providers and an independent assessor each signed off on their share.

Security plan

The system owner writes the security plan, which describes the system, its authorization boundary, its security categorization and how each selected SP 800-53 control is implemented, including which controls are inherited from a common control provider. The AO checks that the boundary matches the systems actually deployed, that the categorization follows from the information types, and that each control states who implements it and where the evidence lives. A plan that says "implemented" without naming a mechanism is a finding before the assessment starts.

Privacy plan

The privacy plan is written by the senior agency official for privacy or the privacy office, with system owner input, and records how the system handles personally identifiable information. The AO checks that PII types, purposes, retention and sharing are described consistently with the security plan, and that privacy controls from the privacy baseline are either implemented or justified. Gaps between what the system stores and what the privacy plan admits are the most common reason this part is returned.

Security assessment report

An independent control assessor produces this report by testing each control with the examine, interview and test methods in SP 800-53A. The AO checks that every control in scope has a documented result, that the assessor was independent of the team that built the system, and that findings are tied to specific evidence rather than to statements from the owner. SP 800-37 Rev. 2 also allows a comparable report that meets the same content requirements to serve as the assessment report, so the AO should confirm the content, not the label.

Privacy assessment report

The privacy assessment report records how an assessor tested the privacy controls in the privacy plan against the SP 800-53A procedures for those controls. The AO checks that the assessor tested PII handling in the running system rather than only reading the policy, and that each privacy finding has a stated risk and a response. Where the same assessor performed both security and privacy testing, the AO should confirm that the two reports do not contradict each other on shared controls.

Plan of action and milestones

The system owner maintains the plan of action and milestones (POA&M), which lists every weakness the assessment found, the planned remediation, the responsible person and the scheduled completion date. The AO checks that each weakness from the assessment report appears here, that dates are realistic and tied to a named resource, and that items accepted as residual risk are explicit about who accepted them. An empty POA&M after a first assessment is a signal to ask how the assessment was scoped.

Terms, conditions and termination date: what the decision sets

This table compares the three things an authorization decision can convey under SP 800-37 Rev. 2: terms and conditions, a termination date or time-driven review frequency, and the impact level supported for common controls. Read each row as a question to answer in the decision document and in your own operating procedures, since the system owner must acknowledge and implement every term.

Element	What the decision sets	Who acts on it and what happens if it slips
Terms and conditions	Conditions attached to the authorization that the authorizing official sets for operating the system, such as required remediation or operating limits.	The system owner acknowledges and implements each term. Failing to meet a term is a reason to revisit the authorization with the authorizing official.
Authorization termination date	A fixed date or time on which the authorization ends unless it is renewed or the system moves to a different authorization approach.	The system owner must plan reauthorization before the date. If the date passes without a valid decision, the system is not authorized to operate.
Time-driven authorization frequency	An interval at which the authorization must be reviewed, used in place of a fixed termination date where the decision calls for time-driven reviews.	The system owner tracks the interval and supplies the evidence the authorizing official needs for each review. Confirm the exact frequency in the signed decision document.
Impact level for common controls	For common controls only, the impact level the controls support, which tells inheriting systems how far the inherited controls can reach.	Systems inheriting common controls must not rely on them beyond the stated impact level. Confirm the level with the common control provider before inheriting.
Acknowledgement by the system owner	The system owner signs or otherwise acknowledges the terms, showing the owner accepts responsibility for implementing them.	Acknowledgement is a documented step. Keep the signed copy with the authorization package so assessors can trace it.
Breach of a term	A term that is not met in operation, such as an unremediated finding tied to a condition.	Report the breach to the authorizing official and follow the decision's stated path, which may include a new risk decision or revocation. Confirm the path in your decision document.
Authorization decision responsibility	The authorizing official alone decides and signs the authorization, including its terms and dates.	Terms cannot be quietly changed by the system owner or a designated representative. Any change requires a new decision by the authorizing official.

How the ATO moves from assessment to decision

The sequence turns assessed control results into a documented risk decision that only the authorizing official can make. Each phase produces a specific artifact, and the decision carries terms that the system owner must accept and implement.

Assessor tests the controls independently
An independent control assessor examines, interviews and tests the selected SP 800-53 controls against the assessment procedures in SP 800-53A, using the system's actual configuration and records rather than documents alone. The assessor records a finding for each control objective that is not fully met. The output is a security assessment report that states what was tested, how, and what was found. Done means every selected control has a documented result, including those that are satisfied, partially satisfied or not satisfied.
Remediate findings and record open items
The system owner and control providers fix what can be fixed before the decision and document the results. Weaknesses that remain open are entered in the plan of action and milestones with the responsible party, the planned corrective action, and the scheduled completion. Residual risk from each open item is described so the authorizing official can see what is being accepted. Done means every finding either has evidence of remediation or has a POA&M entry the authorizing official can review.
Assemble the authorization package
The system owner compiles the authorization package, which SP 800-53A identifies as the security plan, privacy plan, security assessment report, privacy assessment report and plan of action and milestones. Each document must match the others, so the plan describes the controls the assessment tested and the POA&M reflects the assessment findings. Done means the package is complete, internally consistent and ready for the authorizing official to read without gathering missing material.
Authorizing official reviews the risk
The authorizing official reviews the package and decides whether the risk to organizational operations, assets and individuals is acceptable. This review is the core of RMF Task R-4 in SP 800-37 Rev. 2. The authorizing official may ask the team for clarification, more evidence or additional remediation before deciding. Done means the authorizing official has examined the residual risk and the open POA&M items and is prepared to make a decision.
Authorizing official signs the decision
The authorizing official issues the decision: an authorization to operate, an authorization to use, a common control authorization, or a denial. The authorizing official personally signs the decision document, since SP 800-37 Rev. 2 treats the decision and its signature as the one activity that cannot be delegated to a designated representative. Done means a signed decision document exists and the decision type, date and scope are recorded.
System owner acknowledges and implements the terms
The decision document states the terms and conditions of the authorization, an authorization termination date or a time-driven authorization frequency, and, for common controls, the impact level they support. The system owner acknowledges these terms in writing and assigns the work needed to meet them, such as POA&M deadlines, reassessment cycles and monitoring obligations. Done means the acknowledgment is on file and each condition has a named owner and a tracked action.

How FedRAMP Rev5 agency certification depends on an ATO

A FedRAMP Rev5 Agency Certification cannot be obtained without a completed authorization to operate from a federal agency. The FedRAMP certification rules require the provider to complete an ATO with an agency sponsor and to send a signed ATO letter to FedRAMP. The ATO is therefore the gate: the agency's authorizing official must review the authorization package, accept the residual risk and sign the decision before the provider can move forward. The organization that operates the cloud service owns that path, and an implementation partner can prepare the system security plan, assessment evidence and plan of action and milestones, but the agency's decision and the signed letter must come from the agency and the provider's own leadership.

Classes B, C and D carry an additional requirement. FedRAMP expects a fresh initial independent assessment from a FedRAMP Recognized assessment service, completed within the previous 3 months. The assessor, not the cloud provider or its consultants, issues that assessment and its report. Readers planning a timeline should work backward from the expected ATO date, check when the assessor's fieldwork would need to finish to fall inside that three-month window, and confirm with the assessor how much time the report review and remediation cycle will take. Organizations that treat the assessment as a one-time document often find the window closes before the agency signs.

Current requirements change between consolidated rule releases, so the wording above should be checked against the FedRAMP certification rules before any contract or timeline is committed. Confirm the applicable class with the FedRAMP class guidance, confirm the assessment recency rule for your class, and ask the agency sponsor which ATO documentation it will accept. Treat the published rules as the authority for these requirements, and treat any summary, including this one, as a starting point for that check.

Who does what in an ATO: agency, provider and assessor

The authorizing official (AO) is the senior official who formally accepts the risk of operating the system. Under SP 800-37 Rev. 2, this is the only organizational official who can accept security and privacy risk to organizational operations, assets and individuals. For federal agencies the role is an inherently governmental function, so it is assigned only to government personnel. The AO may delegate preparation work to a designated representative, but the authorization decision and the signature on the decision document stay with the AO.

Reviewing the package: The AO reads the security plan, privacy plan, security assessment report, privacy assessment report and plan of action and milestones before deciding.
Deciding on risk: The AO issues an authorization to operate, denies one, or grants an authorization to use or a common control authorization.
Setting terms and conditions: The decision states the conditions of the authorization, an expiry date or a time-driven review frequency, and for common controls the impact level they support.
Accepting residual risk: The AO's signature records that the remaining risk is acceptable for the mission, and this acceptance cannot be handed to a contractor.
Governing reauthorization: The AO decides how changes, ongoing monitoring results and POA&M progress affect the authorization over time.

Before engaging any partner, confirm with the agency who the AO is, which designated representative (if any) will work with your team, and the exact format the agency requires for the decision document.

Questions buyers ask about ATOs under NIST 800-53

Who can sign an authorization to operate under NIST 800-53?

Only the authorizing official can sign the authorization decision, and that decision cannot be delegated. Under SP 800-37 Rev. 2, the authorizing official is a senior official who formally assumes responsibility for operating the system and is the only organizational official who can accept security and privacy risk to organizational operations, assets and individuals. For federal agencies, the role is an inherent U.S. Government function assigned only to government personnel. An AO may delegate preparatory work to a designated representative, but the authorization decision and the signing of the decision document stay with the AO. A contractor, consultant or implementation partner cannot sign or accept the risk on the agency's behalf.

Can a contractor obtain an ATO for its own system?

A contractor does not obtain an ATO in its own right. The authorization is granted by a government authorizing official for a system the government is responsible for, or for a system that a contract requires to be authorized. The contractor's job is to operate the system to the agreed terms, prepare the security plan, assessment evidence and plan of action and milestones, and implement the conditions the AO sets. Contract language, the agency's sponsor and the authorizing official determine who must hold each document. Confirm the exact authorization path, the sponsoring agency and the required package format with the contracting officer and the AO before work starts.

What does an ATO cost, and what drives the price?

No supplied figure sets a cost for an ATO, so ask for an itemized quote built from the written scope. The main components are the categorization and boundary work, control selection and tailoring, implementation of missing controls, the independent control assessment, remediation, the authorization package, and ongoing monitoring after the decision. Some items are one-time, such as the first package and assessment, while monitoring, vulnerability scanning, reassessment and change notifications recur. Costs rise with system complexity, the impact level, the number of inherited controls that must be verified, and the state of existing evidence. Ask each vendor which items are fixed-scope, who performs the independent assessment, and what the quote excludes.

How long does it take to get an ATO?

The supplied sources do not give a standard duration for an ATO, and federal implementation timelines are left to OMB Circular A-130 and the agency. Confirm the expected timeline with the authorizing official and your sponsoring agency, since they set the review cadence and the decision date. The time depends on how complete your control implementation is, whether the assessment is independent, how many findings must be closed before the decision, and how quickly the AO and the agency's reviewers respond. A fixed-scope implementation partner can agree milestones in writing, but only the AO sets the date of the decision.

Can our team prepare the authorization package without an outside partner?

Yes, an organization can prepare the package with its own staff, provided the people involved understand the controls and the authorization boundary. SP 800-53A, citing SP 800-37, says the package consists of the security plan, privacy plan, security assessment report, privacy assessment report and plan of action and milestones. The assessment report must come from an assessor, and SP 800-37 notes that a comparable report meeting the content requirements can serve in that role. An implementation partner can prepare systems, configuration evidence and draft documents, but it does not write the authorization decision or issue assessment reports. Ask whether your AO accepts internally prepared assessments and which independence rules apply.

How does an ATO relate to FedRAMP Rev5 certification?

A FedRAMP Rev5 Agency Certification requires a completed ATO, the agency sponsor and a signed ATO letter sent to FedRAMP. The ATO is the agency's risk decision, so an agency must authorize the system before FedRAMP can recognize the certification. Separately, FedRAMP requires Class B, C and D applicants to provide a fresh initial independent assessment from a FedRAMP Recognized service completed within the previous 3 months. Check the current FedRAMP rules for the class and type that fit your service, because the assessment window and the agency steps are defined there. Confirm the sequence with your sponsoring agency and the FedRAMP rules before committing to dates.

Checks before hiring a partner to prepare an ATO package

An ATO package is only as useful as the authorizing official's willingness to rely on it, and the partner you hire shapes that trust. The checks below separate who builds the evidence from who judges it, and make the decision, the scope and the handover explicit before any work starts.

Confirm the assessor is independent

The security assessment report is a key document the authorizing official reviews, so the person who tests the controls should not be the person who configured them. Ask whether the assessor took part in building the system, the security plan or the remediation work. If the same team does both, ask how the assessment will be documented so an outside reviewer can see what was tested and what was fixed. Confirm this in writing before scoping begins.

Ask for packages the AO accepted

Ask which authorization packages the partner has prepared and whether any were accepted by an authorizing official in a federal or regulated setting. Request a description of the package structure: security plan, privacy plan, security assessment report, privacy assessment report and plan of action and milestones. Be aware that a partner cannot promise acceptance, and any claim of a guaranteed outcome should prompt questions.

Confirm who owns the controls and the decision

The organization owns its controls and the risk decision. The partner prepares systems, configurations and evidence, and the authorizing official alone accepts risk and signs the decision document. Ask the partner to name, in writing, which deliverables it hands over and which decisions stay with your organization. A partner that offers to make risk decisions for you is outside the role it should play.

Require a written scope and deliverables

Ask for a written scope that lists the system boundary, the baseline or tailored control set, the assessment method for each control family, and each deliverable with its owner. Confirm whether the scope covers the security plan, the assessment and the plan of action and milestones, or only part of them. Fixed-scope agreements make it clear what is paid for, what is excluded, and what triggers a change order.

Plan the evidence handover and upkeep

Ask how evidence will be delivered: where it is stored, in what format, and who keeps it current after the authorization decision. Evidence that exists only in the partner's tools will not survive a change of provider. Confirm that the organization receives configuration baselines, scan outputs, logs and assessment records in a form its own staff can maintain, and agree who updates them when the system changes.

How DeployOpen prepares systems and evidence for an ATO

DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure so the system is ready for an authorizing official to review. The organization owns its controls and the risk decision, and DeployOpen prepares the systems, controls and evidence that go into the authorization package. Only the authorizing official can grant an ATO, and assessments are performed by the independent assessors the organization engages.

How we scope

Written scope agrees the system boundary, the SP 800-53 baseline in use and the systems that feed the authorization package.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
Scope names which documents DeployOpen prepares and which are owned by the organization's authorizing official and assessors.

How we build

Systems are implemented in the client's cloud accounts, data centers or air-gapped networks with controls configured to the agreed baseline.
Control implementation statements are drafted against each control's assessment procedure so assessors can trace each claim to evidence.
Testing covers application, API, cloud and infrastructure security so findings can feed the plan of action and milestones before assessment.

How we hand over

The security plan, privacy plan inputs, evidence set and plan of action and milestones are delivered as organization-owned documents.
Each artifact is mapped to the assessment objects the independent assessor will examine, interview and test.
Handover includes runbooks and configuration records so the organization can operate the system after the authorization decision.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the authorization decision.
Retainers can keep evidence current as configurations change, supporting the terms and conditions the authorizing official sets.
Changes that affect the authorization boundary are reviewed with the organization before they reach production.