Skip to content
cairnenclaveIL5 and below · National security
Menu
HomeMethodWorkbench

Who signs · IATT then ATO then cATO

IATO is gone. A pipeline is not a cATO.

IATT is bounded test. ATO is the AO's risk decision on this mission. cATO is Monitor after ATO — McKeown memo, 3 Feb 2022 — continuous monitoring, active defense, an approved DevSecOps design. Platform One demonstrated the practice. It did not write the memo.

The sequence

Test. Then operate. Then Monitor. Not a skip.

Three letters. In this order. IATO is not on the paper.
  1. 1IATTAO · Authorize for test
  2. 2ATOAO · Authorize for operations
  3. 3cATOAO · Monitor after ATO
AO · Authorize for testIATTGranted only when an operational environment or live data is required to complete specific test objectives. Expires when testing completes. Time, testers, data, environment, exit.Not: Production. Standing users. A DISA PA. A purchase.
AO · Authorize for operationsATOA risk decision on a specific mission system, including what it inherits and what it still owns. DoDI 8510.01 Authorize. Residual stays named.Not: A DISA PA. A FedRAMP JAB P-ATO. Reciprocity that nobody wrote down.
AO · Monitor after ATOcATODoD CISO policy (McKeown memo, 3 Feb 2022). Does not expire while the posture holds. Does not replace the underlying ATO.Not: A synonym for pipeline. A purchase. Score 4.

IATO

The letter is gone. Do not write it on the paper.

IATO is gone

Operate with ATO or IATT. There is no third letter that lets you run in production while the package is unfinished.

Operate with

ATO or IATT. There is no parking letter while the package is unfinished.

cATO

Three requirements. After an ATO. In Monitor.

McKeown memo · 3 Feb 2022. Three requirements. After an ATO, in Monitor.
cATOContinuous monitoringNear-real-time RMF control awareness for the AO. Not a reconstructed binder.
cATOActive cyber defenseIn real time. A weekly report is not defense.
cATOApproved DevSecOps designA specific DoD Enterprise DevSecOps Reference Design. Not any pipeline.

Not this

Evidence informs. Named individuals with authority decide.

  • Not IATOThe letter is gone. Operate with ATO or IATT.
  • Not A pipeline as cATOPlatform One demonstrated the practice. It did not write the memo.
  • Not Score 4 as authorizationEvidence quality toward Monitor. The AO still signs.
  • Not A PA as the ATOThe offering may host. This mission may not, yet.

Phase Zero

Name the first occupancy as IATT. Do not occupy it.

Phase Zero artifact
Leave with the sponsor

First occupancy named as IATT, not operations. Prime, folder, testers, data, exit. IATO not on the paper.

Not occupancy

Phase Zero does not occupy. It leaves the sponsor able to ask the AO for a bounded test — or to say not yet.

Score 4 is evidence quality toward Monitor. It is not authorization.

Open the workbenchAll vignettesIATTFive artifactsHow the kit thinks