Topic · ato

Authority to Operate

Authority to Operate — the federal authorization decision that lets a system run in production.

RSS feed ↗

vendor
Amazon Managed Grafana clears FedRAMP High in GovCloud
The authorization solves an observability procurement problem, but GovCloud users still inherit a narrower Grafana feature set.
AWS says Amazon Managed Grafana is now FedRAMP High authorized in AWS GovCloud (US-East) and AWS GovCloud (US-West). Federal agencies, public-sector organizations, and enterprises with FedRAMP High requirements can use the service to visualize, query, and alert on operational metrics across AWS and hybrid environments. The authorization is real buying-path progress; the implementation still depends on GovCloud-specific service limits.
JUL 17
trade-press
VA OIG raises PATS-R risk after low-risk cloud review
A medical-records access path does not become low impact because most users say they do not need it.
FedScoop reports that the VA Office of Inspector General found the Patient Advocate Tracking System-Replacement was wrongly categorized as low risk after its November 2023 cloud transfer, despite access to veteran medical records. VA’s IT office raised PATS-R to moderate after March 2025 preliminary findings. Assessors and agency CISOs should notice the harder point: access controls and user reviews, not the label, are where the audit found the real exposure.
JUL 7
trade-press
NSPM-12 puts National Security Systems cloud policy on 90-day clock
The memo ties inventory, cloud authorization and NSA oversight together, which turns stale system maps into compliance exposure.
A NextGov commentary says NSPM-12 gives federal agencies 90 days to update cloud-security policy for National Security Systems (NSS), requires annual NSS inventories, and formally designates the National Security Agency as National Manager with assessment authority. Agencies, state CISOs working adjacent federal missions, primes and contractors supporting NSS deployments have to align cloud and AI security patterns to those inventories. The open question is whether legacy-heavy agencies get staged compliance or the same penalty clock.
JUN 15

Authority to Operate

Amazon Managed Grafana clears FedRAMP High in GovCloud

VA OIG raises PATS-R risk after low-risk cloud review

NSPM-12 puts National Security Systems cloud policy on 90-day clock