Getting to Continuous Authorization to Operate

One of the most beneficial practices any agency can implement is achieving and maintaining Continuous Authorization to Operate (cATO). It allows an organization to maintain ongoing authorization for their systems and software, rather than having to obtain a one-time ATO for each deployment.

Gaining a cATO requires agencies to implement continuous monitoring of the security of their systems and practicing active cyber defense measures that proactively identify and mitigate threats. By using automation, cATO streamlines compliance checks and workflows, reducing the time and effort to achieve and maintain the ATO, lowering costs and increasing the value of updates. By automating compliance, government agencies can free up resources and accelerate their digital transformation journey.

Learning Objectives:

• Examine the ways using automation and continuous monitoring of security controls fits within the National Institute of Standards and Technology’s Risk Management Framework
• Outline metrics that can be used to measure time and labor savings by implementing a cATO, including lowered costs and faster delivery cycles
• Delineate cATO’s contributions to modernization and transformation objectives