Topic · ato

Authority to Operate

Authority to Operate — the federal authorization decision that lets a system run in production.

RSS feed ↗

trade-press
What breaks AI pilots isn't the model, it's the ATO
Teams build against the wrong environment, bolt explainability on after the fact, and treat the compliance review as a formality, then discover the pilot was a rebuild from day one.
Patrick Bryant, who runs an AI implementation firm working with small and mid-size government contractors, lays out the pattern: agencies have pilots running everywhere, but few systems make it through compliance review into an ATO package for daily use. The models work. What breaks is everything around them, the wrong cloud environment, explainability treated as documentation rather than design, human-in-the-loop reviews that collapse under volume, and vendor-risk paperwork nobody scoped time for. The fix isn't flashy: build the first version inside the actual authorization boundary and run the compliance workstream from day one.
OCT 3
trade-press
Army all but abandons custom-built software for commercial buys
Driscoll's policy update makes commercial solutions the default acquisition path and tells cybersecurity officials to clear products faster, but the continuous ATO framework that would make that work is still in pilot.
Army Secretary Dan Driscoll's July 22 policy directive, published last week, orders the service to default to commercial solutions openings and other transaction authorities for software procurement, reserving custom development for cases where no commercial product meets operational needs. The memo also instructs cybersecurity officials to lean on continuous ATOs and reciprocity agreements to accelerate deployment. But the Army's continuous ATO framework (launched in pilot under CIO Leonel Garciga) hasn't yet reached production, leaving the security review model the policy depends on in an unfinished state.
AUG 27
trade-press
NIST IR 8613 maps multi-cloud security seams
The draft catalogues exactly where single-provider ATO frameworks break when agencies run workloads across AWS, Azure, and GCP, and the comment period signals this isn't staying theoretical.
NIST published draft IR 8613 on August 21, cataloguing security and authorization-to-operate challenges unique to multi-cloud environments. The report, produced by NIST's Multi-Cloud Security Public Working Group, identifies five structural gaps where alignment is most urgent: identity and access management, telemetry and logging, configuration and change management, data protection, and compliance and authorization. Comments close October 5. The publication validates what practitioners have long known (that ATO processes built for a single provider don't survive contact with a second one) and tees up potential guidance or standards work to follow.
AUG 25
trade-press
DIU Bridge Program targets cyber ATO bottleneck
Halving cyber authorization timelines would be the most significant ATO reform in a decade; the Bridge Program has twelve months to prove it's not another memo.
DIU launched the Bridge Program this week, led by Sarah Pearson, with a one-year mandate to open co-use classified facilities nationwide and "slash cyber authorization timelines by half." Multiple commercially owned sites are already contracted across nine states, with DIA, DCSA, and the military services partnering on a joint funding model. West's memo pins the problem precisely (promising technology dies in the clearance-authorization-budgeting cycle) but a memo doesn't fix the ATO pipeline; only demonstrated throughput does.
AUG 25
trade-press
VA Rejects All 19 FISMA Recommendations as CIO Vacancy Hits Two Years
Zero-trust dollars are appropriated, but the department rates itself at the lowest maturity rung for its core defenses, and there's no published plan to change that.
A FISMA audit found VA's information security program deficient in seven areas, yielding 19 OIG recommendations. VA concurred with none, dismissing the audit as "a snapshot in time." The department has operated without a Senate-confirmed CIO for two years and has cycled through two acting CISOs. Meanwhile, zero-trust funding increased in the FY2026 budget, but VA's own assessment puts its defenses at the lowest maturity rung, with no published plan connecting the spending to outcomes.
AUG 25
trade-press
Army shifts cloud management to Cyber Command
The move puts the organization that buys Army cloud under the command that defends it, folding procurement into the zero-trust and continuous-ATO push.
Army Secretary Dan Driscoll signed an order Monday reassigning the Enterprise Cloud Management Activity from the CIO's office to Army Cyber Command. ECMA runs the cArmy ecosystem, managing enterprise contracts, CSP relationships, and the CAMO vehicle that procures cloud for IL5 workloads and below. The move puts the organization that buys cloud under the command that defends it, folding procurement into the Army's zero-trust and continuous-ATO push. It arrives two months after former CIO Leo Garciga, who drove the continuous-ATO framework, departed.
AUG 25
trade-press
$1.1B VA benefits platform overhaul lacks schedule, cost estimate, OIG finds
The Booz Allen contract was supposed to close this month. The new target is Q2 2034, and VA never built a GAO-compliant schedule or lifecycle cost estimate.
A VA OIG audit found the $1.1 billion Benefits Enterprise Platform modernization, a Booz Allen Hamilton contract meant to close this month, has been pushed to Q2 2034 with no GAO-compliant program schedule and no reliable lifecycle cost estimate. The watchdog also found OIT hosted applications without required security assessments, leaving vulnerabilities unaddressed since 2021. VA concurred with the recommendations. The platform supports pension, vocational rehabilitation, and employment benefits systems, so the eight-year slip doesn't stop at BEP; it cascades across every business line that depends on it.
AUG 11
trade-press
Cloudflare lands FedRAMP High, eyes DOD IL4
FedRAMP High and GovRAMP Moderate are real; the IL4 pursuit is still just a declared intention.
Cloudflare achieved FedRAMP High authorization Thursday, allowing civilian agencies to use its platform for High-impact data covering national security, critical infrastructure, financial systems, and other sensitive workloads. GovRAMP Moderate followed in April for state and local governments. The company also announced it plans to seek DOD Impact Level 4 authorization for CUI workloads, but that's a declared intention, not a review in progress. DISA issues IL4 provisional authorizations under the DoD Cloud Computing SRG, and Cloudflare hasn't begun that assessment process. DOE, HHS, Commerce, DHS, Interior, Justice, and State already use Cloudflare technologies.
AUG 10
trade-press
VA Drops FedRAMP Pre-Cert for Vendors, GSA Flips Standards Playbook
VA decouples procurement from FedRAMP without lowering the security bar, and GSA finally admits that building standards before touching technology is backward.
VA told acquisition teams vendors no longer need FedRAMP certification before competing for VA business, the ATO stays, but the pre-competition gate is gone. Separately, GSA is inverting the standards timeline: test technology first, then feed results back into standards, a reversal of the traditional two-to-three-year policy-first sequence. OneGov has signed more than two dozen tech companies and flagged $1.18 billion in savings.
AUG 7
trade-press
Salesforce Agentforce 360 clears DOD IL5 for CUI data
The authorization is a genuine compliance gate for CUI workloads, but the vendor's "first" framing ignores the eight companies already running AI at DOD's classified tiers.
Salesforce's Agentforce 360 platform received DOD Impact Level 5 authorization Wednesday, clearing it to store and process Controlled Unclassified Information and unclassified National Security Systems data across the department. The authorization, hosted on AWS GovCloud, puts Army Human Resources Command down as the first named customer. The IL5 milestone is a real compliance gate, but Salesforce's "first commercial software company bringing an agentic platform into national security" framing strains against the eight AI vendors DOD already has operating at the higher IL6 and IL7 classified tiers.
AUG 5
trade-press
OMB says compliance bottlenecks still slow agency AI deployments
FedRAMP 20x has cut authorization time from over a year to five weeks for the pilot, but federal CIOs still can't get AI capabilities fielded at the speed they want, and the shadow IT that results is a feature of the compliance burden, not a side effect.
OMB federal cybersecurity branch director Nick Polk told a Digital Government Institute summit that reducing compliance bottlenecks for frontier AI model access is a "clear focus" of the federal CIO. FedRAMP 20x has accelerated (114 authorizations in FY 2025, four AI services through the 20x pilot) but Polk said no agency CIO is satisfied with time-to-ATO. CISA and Treasury are doing the operational learning, with CISA deploying Anthropic's Claude Mythos since June to scan federal open-source repos for vulnerabilities. Polk also flagged the identity-threat vector: North Korean actors are using AI capabilities to escalate federal credential attacks.
JUL 31
trade-press
VA drops pre-award FedRAMP requirement for cloud contracts
VA is betting that post-award security outcomes matter more than pre-award paperwork, but the 60-day ATO clock will decide whether the bet holds.
The Department of Veterans Affairs will no longer require cloud service providers to hold FedRAMP certification at contract award, per a memo from Principal Deputy Assistant Secretary Zack Schwartz obtained by FedScoop. Contractors must instead achieve a VA Authorization to Operate within 60 days of award, meeting NIST standards and VA security requirements before any system goes live. The policy opens the door for primes, subs, and ISVs that lack pre-existing FedRAMP status. But it shifts the authorization burden to post-award, where timeline risk now lives.
JUL 29
vendor
Amazon Managed Grafana clears FedRAMP High in GovCloud
The authorization solves an observability procurement problem, but GovCloud users still inherit a narrower Grafana feature set.
AWS says Amazon Managed Grafana is now FedRAMP High authorized in AWS GovCloud (US-East) and AWS GovCloud (US-West). Federal agencies, public-sector organizations, and enterprises with FedRAMP High requirements can use the service to visualize, query, and alert on operational metrics across AWS and hybrid environments. The authorization is real buying-path progress; the implementation still depends on GovCloud-specific service limits.
JUL 17
trade-press
VA OIG raises PATS-R risk after low-risk cloud review
A medical-records access path does not become low impact because most users say they do not need it.
FedScoop reports that the VA Office of Inspector General found the Patient Advocate Tracking System-Replacement was wrongly categorized as low risk after its November 2023 cloud transfer, despite access to veteran medical records. VA’s IT office raised PATS-R to moderate after March 2025 preliminary findings. Assessors and agency CISOs should notice the harder point: access controls and user reviews, not the label, are where the audit found the real exposure.
JUL 7
trade-press
NSPM-12 puts National Security Systems cloud policy on 90-day clock
The memo ties inventory, cloud authorization and NSA oversight together, which turns stale system maps into compliance exposure.
A NextGov commentary says NSPM-12 gives federal agencies 90 days to update cloud-security policy for National Security Systems (NSS), requires annual NSS inventories, and formally designates the National Security Agency as National Manager with assessment authority. Agencies, state CISOs working adjacent federal missions, primes and contractors supporting NSS deployments have to align cloud and AI security patterns to those inventories. The open question is whether legacy-heavy agencies get staged compliance or the same penalty clock.
JUN 15