Ongoing authorization and continuous ATO: what it takes

When can a system move to ongoing authorization and continuous ATO?

SP 800-37 Rev. 2 allows a system to drop its fixed authorization termination date only when the continuous monitoring program is mature enough for the authorizing official (AO) to make ongoing risk determinations. That decision belongs to the organization and its AO, not to a consultant, a cloud provider or an auditor. If your three-year ATO cycle is costly and a contract or agency now asks about continuous ATO, the question to answer first is whether your monitoring program can support the AO's decisions without a periodic re-authorization. In place of the termination date, the standard has you set an authorization frequency, which defines how often the AO reviews security and privacy information and decides whether operation remains acceptable.

The answer differs by organization for three reasons. The first is monitoring maturity: whether you assess controls on a defined schedule, correlate results, and report posture to the AO at a defined frequency, as the CA-7 control in SP 800-53 Rev. 5 expects. The second is change rate: a system that ships code weekly or changes its boundary often needs a monitoring program that detects significant changes quickly, while a stable system with few changes presents a smaller monitoring load. The third is the AO's appetite for risk, which is a documented judgment about what residual risk the agency or organization will accept between reviews. Confirm each of these with your AO before you ask for a change in terms.

Start by mapping your current ISCM strategy against the frequencies and reporting you would commit to, and ask the AO which evidence they would need at each review. Check whether your plan of action and milestones and vulnerability remediation records are current, since stale records are the usual reason an AO declines a change. If a customer or contract requires continuous ATO, ask them in writing which authorization frequency and reporting cadence they expect. Any implementation partner can help build the monitoring evidence, but the AO's acceptance of risk and the decision to remove the termination date remain with your organization.

Which monitoring capabilities the AO will expect to see

Under ongoing authorization, the authorizing official keeps accepting risk only while the continuous monitoring program produces trustworthy, current answers. CA-7 in SP 800-53 Rev. 5 breaks that program into connected elements, and each one leaves artifacts an assessor or AO can inspect.

Defined metrics and strategy

CA-7 expects a system-level continuous monitoring strategy that is consistent with the organization-level strategy and names the metrics the system reports on. Check that each metric has a defined owner, data source and threshold, and that the strategy document is dated and approved. Ask for the current ISCM strategy and a sample metric definition. Release 5.2.0 updated CA-7 and related controls, so confirm your strategy cites the current release.

Monitoring and assessment frequencies

The strategy must state how often each control is monitored and how often it is assessed, because the AO relies on those intervals to judge whether the authorization is still valid. Frequencies should differ by control risk, not be one number for everything. Check that the schedule matches what the scanners and log pipelines actually run, and that missed cycles are recorded. Evidence includes the schedule, job history and exception records.

Ongoing control assessments

Ongoing assessment means controls are tested on a rolling schedule rather than once per authorization cycle. Each assessment should follow the procedures in SP 800-53A and produce a result for the specific control, with the assessor's name and date. Check that assessment logs cover the full control set over the defined period, not only the controls that are easy to test. Evidence includes assessment logs, test scripts and signed results.

Correlation and analysis of results

Raw scanner and log output does not tell the AO whether risk has changed. CA-7 expects monitoring results to be correlated and analyzed so that related findings, such as a vulnerability on a system with a failed configuration check, are seen together. Check that the analysis has a named reviewer and a documented method. Evidence includes correlation rules, analysis notes and trend reports that a reviewer can reproduce.

Response actions and POA&M records

When monitoring finds a weakness, the program must decide and record a response: remediate, accept, or escalate. Check that each finding links to a plan of action and milestones entry with an owner, due date and status, and that closure requires evidence. Overdue items should trigger escalation. Evidence includes the POA&M, change tickets that closed findings and records of risk acceptance signed by the right authority.

Reporting to defined personnel

CA-7 requires security and privacy status to be reported to defined personnel at a defined frequency. The AO needs this report to decide whether continued operation remains acceptable. Check that the recipients and cadence are written down, that the report shows changes since the last period, and that the AO's response is recorded. Evidence includes dated reports, distribution lists, dashboard exports and minutes of AO review.

How to move from a fixed ATO to ongoing authorization

The sequence turns a fixed authorization termination date into an AO-approved ongoing authorization, backed by a continuous monitoring program that produces evidence the AO can act on at each defined review.

Confirm continuous monitoring maturity
Compare the current monitoring practice against the system-level continuous monitoring strategy that CA-7 requires, covering defined metrics, monitoring and assessment frequencies, ongoing control assessments, correlation of results, response actions and reporting. The system owner and ISSO run this gap review, and the AO's designated representative should see the results. The step is done when every CA-7 element has either an operating practice with records or a documented gap with an owner. Confirm with the AO how much maturity they expect before they will consider ongoing authorization, because SP 800-37 Rev. 2 leaves that judgment to the AO.
Document the monitoring program and frequency
Write the continuous monitoring program into the system's documentation: the metrics tracked, the assessment and monitoring cadence for each control group, the vulnerability handling approach, the change tracking method and the escalation path. The system owner drafts it and the AO accepts it. The output is an approved monitoring strategy plus a stated authorization frequency, the interval at which the AO will review security and privacy information. Ask the AO which frequency they will accept and confirm it against your own risk tolerance and change volume, since no supplied fact sets a standard interval.
Agree the reporting content with the AO
Work with the AO's office to define what each periodic report contains: control assessment results, open plan of action and milestones items, significant changes, risk assessment updates, impact analyses and the overall security and privacy posture. The authorizing official needs enough detail to decide whether continued operation remains acceptable, requires further risk response or warrants denial. The output is a reporting template and a distribution list, signed off by the AO or designated representative. Where the system inherits controls from a common control provider, agree how provider reports feed into this package.
Run monitoring cycles and log outcomes
Execute the monitoring program for one or more full cycles under the agreed strategy. The ISSO or security team performs the assessments, the system owner records changes and responses, and the team keeps every AO interaction in a decision log. Each cycle should produce a completed report in the agreed template, a list of risk responses and the AO's written response. The step closes when the AO has reviewed at least one cycle and the log shows how findings led to action. Confirm with the AO how many cycles they want to see before they will act, because the number and length of cycles depend on the system and the AO's preferences.
Request the AO's decision on the termination date
Submit a formal request asking the AO to remove the authorization termination date and move the system to ongoing authorization. The package includes the monitoring strategy, the authorization frequency, the completed cycle reports, the decision log and an updated risk summary. The AO reviews it and either accepts continued operation under ongoing authorization, requires further risk response or denies authorization. The output is a written AO decision that names the authorization frequency and any conditions. Keep the decision in the authorization record so auditors and inspectors can trace it.
Keep the AO informed between reviews
After the decision, continue monitoring and report at the agreed frequency. The system owner notifies the AO of significant changes, new vulnerabilities that alter risk, and incidents that affect the authorization boundary, using the reporting channel agreed earlier. The AO's office records each review and any change in risk acceptance. The step is ongoing, and the check is whether each periodic review produces a documented AO response on file. If the AO sends the system back to a fixed authorization or requires a new decision, return to the monitoring review and repeat the cycle.

How the decision differs by system and environment

A system with a fixed architecture, a small number of components and infrequent changes is the easiest candidate for ongoing authorization, but only if the continuous monitoring program already produces reliable results. The AO is looking for proof that the organization sees control failures as they happen, not at the next annual assessment. Risk tolerance shifts mainly when a change alters the authorization boundary, adds a new data type or weakens a control that the authorization depended on.

Monitoring results: Recent scan, log review and configuration drift reports showing that findings are triaged and closed on a schedule.
Change record: A short list of changes since the last review, each with its impact analysis and any effect on the security plan.
Open POA&M items: Current plan of action and milestones entries, with owners and status, so the AO can see accepted risk in one place.
Stable boundary evidence: A current system inventory and diagram showing that nothing has moved outside the boundary.

Confirm with your AO whether a stable architecture alone is enough, or whether they also expect a demonstrated track record of finding and fixing issues before the termination date is removed.

How FedRAMP ongoing certification reports support agency decisions

For a cloud service authorized through FedRAMP, the agency's own decision still rests on its own authorization to operate. FedRAMP rule CCM-AGM-ROR requires each agency to review every Ongoing Certification Report the cloud service provider submits and to judge how the changes described in that report may affect the risk tolerance documented in the agency's ATO. The rule cites 44 USC 35, OMB Circular A-130, FIPS 200 and OMB memorandum M-24-15 as the basis for that duty. The practical task for the agency is to compare each report against the risk tolerance it accepted, not simply to file the report.

The authorizing official remains the decision maker. The provider's Ongoing Certification Reports are inputs that describe changes, vulnerability results, incidents and the status of the continuous monitoring program. The AO, or a designated representative acting within delegated authority, decides whether the change falls within accepted risk, needs further risk response, or requires a fuller reassessment of the authorization. An agency that treats a clean report as an automatic acceptance has not met the requirement. Agency teams should record each review, the change it considered and the outcome, so the decision trail survives staff turnover and any inspector general or assessor later asks how the report was used.

To confirm the current obligations, start with the machine-readable FedRAMP rules in the FedRAMP rules repository, and check the rules version in use with FedRAMP before you write the review procedure into agency policy, since rule text changes between releases. Then map each provider report section to the risk statements in your own ATO package, and agree with the provider in writing how it will flag significant changes between reporting cycles. Those steps determine whether ongoing authorization works in practice for your agency.

Common questions about continuous ATO

Can a system move to ongoing authorization without a mature continuous monitoring program?

No. SP 800-37 Rev. 2 only allows the authorization termination date to be removed when the continuous monitoring program is mature enough for the authorizing official (AO) to make ongoing risk determinations. The logic is that the AO drops the fixed expiry only after the organization can show current control assessments, documented changes, risk analyses and posture reporting on a routine basis. If monitoring is still periodic, manual or incomplete, the system keeps a termination date and goes through a full reauthorization. Before asking the AO to change the model, confirm that your ISCM strategy under CA-7 is operating, that its results are reviewed, and that findings reach a responsible decision-maker on schedule.

Who sets the authorization frequency for an ongoing authorization?

The organization sets it, and the AO accepts it. SP 800-37 Rev. 2 replaces the termination date with a defined authorization frequency, so the organization must decide how often the AO reviews the security and privacy information for the system. That decision belongs in the authorization documentation, and the AO must agree that the frequency is adequate for the system's risk. Factors that shape the choice include the system's impact level, how quickly threats and changes arrive, how often FedRAMP or agency reporting requires updates, and how much assessment data the monitoring program produces. Ask your AO to approve the frequency in writing and record it in the authorization package.

Does an independent assessor have to sign off on continuous monitoring results?

Independent assessors perform the control assessments that feed ongoing authorization, but the AO makes the risk decision. The distinction matters because the assessor reports findings and the AO accepts continued operation, requires further risk response or denies authorization. Assessment independence is a separate question from authorization. Your monitoring program should define which controls are assessed by an independent party, at what frequency, and how those results are recorded. Confirm the assessor's role and independence requirements with your AO and your agency or sponsor before the transition, since the conditions depend on the authorizing body.

What does continuous ATO require from internal staff?

It requires staff who own the monitoring data every day, not only at the time of assessment. Typical roles include a system owner who answers for changes, a security team that triages scanner and log output, an engineering team that tracks configuration and change records, and a compliance lead who keeps the system security and privacy plan, plan of action and milestones, and reporting current. Most organizations also need someone who prepares the posture reports the AO reads at each review. Map these roles to named people, define response timeframes for findings, and test whether the team can produce evidence on demand before asking the AO to move to ongoing authorization.

What drives the effort and cost of moving to continuous ATO?

The main drivers are the maturity of existing monitoring, the number of components in the authorization boundary and the amount of change the system sees. A system with automated asset inventory, centralized logging, scheduled scanning and tracked configuration changes needs less new work than one that relies on spreadsheets and annual tests. Effort also rises with the number of controls that need automated evidence, the number of inherited controls that depend on a provider's reporting, and the degree of tailoring. Costs are mostly staff time and tooling, and some are one-time (designing the ISCM strategy, building pipelines) while others recur (running scans, reviewing findings, preparing reports). When requesting a quote, ask which of these items the scope includes and which stay with your team.

Can an implementation partner decide whether our system qualifies for continuous ATO?

No. DeployOpen can help prepare the system, monitoring pipeline and evidence, but the organization owns its controls and the AO makes the authorization decision. An implementation partner does not issue reports, attestations or authorizations. In practice, a partner might configure a self-hosted scanner, set up log collection, document the ISCM strategy, and assemble posture reports for the AO and any independent assessor. Whether the system qualifies depends on the organization's governance, the AO's acceptance and the requirements of the sponsoring agency or contract. Ask the AO early whether the proposed monitoring program would support ongoing authorization, and use that answer to define the written scope.

Who owns each part of an ongoing authorization

This table compares who decides, who prepares inputs and where independence applies in an ongoing authorization. Read each row as a boundary: the organization and its authorizing official own the risk decision, while DeployOpen prepares systems, monitoring output and evidence but never issues assessment reports or authorization decisions.

Role	Decision or output owned	Typical inputs	Independence boundary
Authorizing official (AO)	Accepts or denies continued operation at each defined authorization frequency and sets any further risk response	Ongoing monitoring reports, POA&M status, significant change notices, risk assessment updates	Cannot delegate the risk decision; must not be the party that builds or operates the monitoring output they review
System owner	Operates the system, implements risk responses and maintains the system security and privacy plan	Control implementation records, configuration baselines, incident and change logs	Owns the system but should not grade its own control effectiveness without assessor input
Control assessor	Assesses control effectiveness and reports results to the AO for ongoing review	Assessment procedures from SP 800-53A, evidence samples, monitoring data, system documentation	Should be independent of the team that implemented the controls being assessed
Organization ISCM team	Runs the continuous monitoring strategy, scan schedules, metrics and reporting to defined personnel	Vulnerability scans, log data, configuration drift results, change tickets, metric definitions	Reports to the organization; its metrics must be defined in advance, not adjusted to fit results
Implementation partner (for example, DeployOpen)	Prepares monitoring tooling, control evidence, dashboards and documentation for the organization and its assessors	Scoped system architecture, tool requirements, monitoring design, agreed evidence formats	Prepares systems and evidence only; does not issue assessment reports, authorization decisions or certifications
Independent assessor or auditor	Issues the independent assessment report or attestation, where the program or contract requires one	Assessment plan, system evidence, monitoring records, interviews and tests	Must be independent of the organization, the AO and any partner that prepared the evidence

Why continuous ATO requests stall and how to avoid it

Most continuous authorization requests do not fail on the security posture itself. They fail because the authorizing official cannot see a clear, dated, decision-ready picture of risk. The cards below cover the six gaps that most often leave an AO unable to accept ongoing risk, each with the check that closes it.

Monitoring without AO-facing reports

Scanners, log pipelines and control tests can run every day and still leave the AO with nothing to decide on. CA-7 expects reporting of security and privacy status to defined personnel at a defined frequency, so the output has to be a summary the AO can read. Build a standing report that shows open high-impact findings, control changes since the last review and trends. Check that someone outside the operations team signs off on it before each review.

Undefined review frequencies

Ongoing authorization replaces the fixed termination date with an authorization frequency, so an undefined frequency leaves the system with no authorization rhythm at all. Under SP 800-37 Rev. 2 the AO reviews security and privacy information at that defined interval and either accepts continued operation or requires further risk response. Write the frequency, the monitoring cadence and the reporting cadence into the continuous monitoring strategy, and confirm the AO has agreed to them in writing.

Unmanaged POA&M items

A plan of action and milestones that lists findings without owners, dates or risk ratings forces the AO to guess how much exposure is being carried. Items that quietly slip past their milestones are the most common reason a review gets pushed back. Assign each item an owner, a scheduled completion date and a documented risk acceptance for anything that will remain open. Confirm that every overdue item is visible in the AO report, not only in the tracker.

Significant changes not tied to risk review

Under ongoing authorization, a change to the system can alter the risk the AO accepted, but only if the change reaches the AO. Teams often route infrastructure, identity or dependency changes through normal change tickets with no link to risk. Define which change types are significant, record the impact analysis for each one, and send the AO a notice when the threshold is met. Check that the change log and the risk register point to each other.

Inherited controls without provider evidence

A system that inherits controls from a cloud platform or common control provider still needs the provider's evidence on file. If the provider's assessment results, continuous monitoring reports or change notices are not delivered, the inheriting system cannot show those controls are working. Put the evidence obligations in the inheritance agreement, list which artifacts arrive and how often, and test that they are received. Ask the provider which of its reports cover the inherited controls specifically.

Evidence stored where no one can audit it

Scan results, ticket histories and configuration snapshots kept in personal folders or in tools with no export, retention or access logging cannot support an independent assessment. Assessors need to trace a control statement to the source record and confirm the record was not altered. Store evidence in a system with access control and audit logging, set a retention period, and keep exported copies with timestamps. Confirm that an assessor can reproduce each evidence item from the source.

How DeployOpen prepares monitoring evidence for an AO

DeployOpen plans, implements and documents the self-hosted open-source platforms that produce monitoring evidence for an authorizing official. The organization owns its authorization decisions and continuous monitoring program, and an independent assessor provides the assessment results the AO relies on.

How we scope

Written scope names the systems, monitoring metrics and assessment frequencies the ongoing authorization will cover.
Scope records which controls are assessed continuously, which are assessed on a defined cycle, and who owns each.
Scope sets out the reporting cadence to the AO and the defined frequency for the authorization review.

How we build

We configure self-hosted monitoring tooling inside your own cloud accounts, data centers or air-gapped network.
We wire scanner, log and configuration outputs into a single evidence store that maps results to the CA-7 strategy.
We test that alerts, change records and significant change triggers fire as the documented monitoring strategy describes.

How we hand over

You receive documentation of the monitoring architecture, data flows, owners and the evidence produced for each control.
Runbooks describe how analysts triage findings, record risk responses and update the plan of action and milestones.
Handover includes a dry run of a periodic AO review package so your team and assessors can confirm the evidence is usable.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover, agreed in writing.
Retainer work can cover tooling updates, evidence pipeline fixes and changes to the monitoring strategy after a significant change.
Your organization decides when to accept residual risk, and we prepare the evidence for each decision without making it.

Ongoing authorization and continuous ATO