By An ATO Compliance Roadmap for Program Offices: From Kickoff to the AO's Decision
An Authorizing Official decides on evidence, not on a vendor's speed claim. This roadmap lists the artifacts each RMF step must produce, the controls they evidence, the decisions that stay with the government, and the SOW terms that keep an authorization effort on schedule.
An Authorizing Official does not sign an Authority to Operate because a vendor promises speed. The AO signs because the package describes the system accurately, the independent assessment confirms it, and the residual risk is stated plainly enough to accept. Everything a program office does before that moment either builds that basis or delays it.
The requirement itself is fixed. FISMA requires federal systems to be authorized before they operate, and OMB Circular A-130 (opens in a new tab) binds agencies to the NIST Risk Management Framework and to ongoing assessment afterward. This roadmap is for the program manager, ISSM or ISSO who has to get one system through that process and defend the plan to a review board.
Artifacts by RMF Step
NIST SP 800-37 Rev. 2 (opens in a new tab) defines seven steps. Each should end with artifacts in the agency's system of record, mapped to the NIST SP 800-53 Rev. 5 controls they evidence.
| RMF step | Artifacts the step must produce | Controls evidenced |
|---|---|---|
| Prepare | Stakeholder map, artifact inventory, plan aligned to the AO office's intake | PM-9, PM-10 (organization level) |
| Categorize | FIPS 199 memo with rationale, boundary, diagrams, privacy threshold analysis | RA-2, PL-2 |
| Select | Tailored baseline, tailoring rationale, customer responsibility matrix | PL-2, PM-5 |
| Implement | System Security Plan, contingency, incident response and configuration management plans, inventory, interconnection agreements | PL-2, CP-2, IR-8, CM-9, CM-8, CA-3 |
| Assess | Security Assessment Plan, readiness results, assessment report | CA-2 |
| Authorize | POA&M, residual-risk narrative, AO briefing, authorization decision | CA-5, PM-4, CA-6 |
| Monitor | Continuous monitoring strategy and control assessment calendar | CA-7 |
DoD systems follow the same steps under DoDI 8510.01, with eMASS as the record and CNSSI 1253 governing categorization for national security systems. Privacy artifacts run in parallel: when the privacy threshold analysis finds personally identifiable information, a Privacy Impact Assessment goes to the privacy office on its own clock.
Decisions That Stay With the Government
Three decisions cannot be delegated to a contractor, and the roadmap should name who owns each.
- Categorization approval. The system owner and the ISSM approve the FIPS 199 categorization, because every later control choice depends on it.
- The assessment. An independent assessor tests the controls. The team that prepared the package must not assess it; a firm that does both has an organizational conflict of interest, and a contracting officer should ask about it before award.
- The authorization. The AO grants, denies or conditions the ATO and accepts the residual risk. No contractor delivers or guarantees an ATO, and a proposal that implies otherwise should count against the offeror.
Everything else, from categorization drafts to the AO briefing, can be prepared by a facilitation team working for the system owner.
Common Points of Failure
Most stalled packages fail at one of four points, and each has a control-level fix.
Inherited controls asserted rather than mapped. A FedRAMP-authorized cloud service covers the provider's controls, not the agency's configuration. The customer responsibility matrix must show the tenant's half of every shared control. The provider side is changing too: the FedRAMP Consolidated Rules (opens in a new tab) become mandatory on January 1, 2027, and Rev5 authorizations end on December 31, 2028, so inheritance mappings should be reviewed as providers transition.
An IATT treated as an ATO. An Interim Authority to Test is time-limited permission to test in an operational environment. Its expiration arrives faster than most programs plan for, and the full package still has to be built.
POA&M items without resources. A POA&M is the expected companion of nearly every authorization. Items without an owner, resources and a scheduled completion date are what an AO and an IG question first.
Statements that do not match the system. Assessors use the SP 800-53A methods: examine, interview and test. Implementation statements written as template prose fail all three. Each statement should trace to a named artifact, a configuration export or an interview record.
Where Continuous Authorization Fits
Ongoing authorization changes what happens after the decision, not the need for a sound package before it. DoD's February 2022 cATO memorandum (opens in a new tab) requires programs to demonstrate continuous monitoring of RMF controls, active cyber defense and an approved DevSecOps reference design, and states that continuous authorization can be revoked.
DoD also announced its Cybersecurity Risk Management Construct (opens in a new tab) on September 24, 2025 as RMF's successor. RMF processes, DoDI 8510.01 and eMASS remain in use while implementation guidance is issued. For a program authorizing a system now, the practical guidance is unchanged: build evidence against the controls, and plan the monitoring handoff as a deliverable rather than an afterthought.
SOW Terms That Hold the Schedule
Most authorization delays come from dependencies outside the facilitation team's control. A statement of work should make them visible:
- Named boundary. List the system and its components; boundary changes are change orders.
- Agency obligations with dates. A system owner sponsor, an ISSO available at least four hours a week, engineer interview time, and platform accounts by week three. eMASS sponsorship and, for DoD, CAC issuance start at kickoff.
- Day-for-day relief. When an agency dependency slips, the schedule moves with it, and every status report carries an assumption log.
- Remediation boundary. Documentation fixes and minor configuration changes are in scope; substantive remediation is a change order or a separately engineered remediation effort (opens in a new tab).
- Government-controlled steps. The assessor's schedule and the AO's timeline sit outside the contractor's period of performance.
- Milestone pricing. Firm fixed price per milestone with written acceptance criteria per artifact, and no fee tied to the authorization outcome.
Defending the Plan to a Review Board
A review board will ask what could push the authorization past its date. The answer should be a short register with owners, not a promise of speed:
| Risk | Owner | Containment |
|---|---|---|
| Evidence collection and interviews slip | System owner | Dependency schedule in the SOW; assumption log in every status report |
| Platform access arrives late | ISSM | Requests submitted at kickoff with target dates |
| The boundary grows mid-effort | Program manager | Boundary named in the SOW; changes by change order |
| Assessment findings exceed the plan | System owner | Readiness review before the assessment; POA&M with resources |
Each row has a government owner because each dependency sits on the government side. Naming them early is what lets the board approve a realistic date.
Timing the Effort
An initial Moderate authorization typically takes five to nine months of preparation; a reauthorization with a serviceable package takes three to five. Add the agency's procurement lead time and the AO's review period, and the work for an ATO expiring in mid-2027 has to be on contract months earlier than most programs assume. The monthly cost of authorization delay (opens in a new tab) is what a review board will weigh against the price of starting now.
A fixed-price readiness review of $15K to $40K is the low-risk first step. It runs the existing package against the SP 800-53A procedures and tells the program whether it faces a reauthorization or a rebuild.
Avalon's ATO Process Facilitation service is the execution layer for this roadmap. It produces the categorization package, System Security Plan, plan set, evidence library, readiness report, POA&M and AO briefing in your system of record, and positions the system for the independent assessment and the AO's risk decision.
