# Authorization to Operate **Aliases:** ATO **Entity class:** Accountable system-risk decision ## Definition An **Authorization to Operate (ATO)** is an accountable decision accepting the residual security and privacy risk of operating a system for a defined mission, environment, and period or under ongoing authorization conditions. It is not proof that a system is risk-free. ## Relationships - **produced by:** [[wiki/Risk Management Framework|Risk Management Framework]]. - **supported by:** control implementation and assessment, [[wiki/Continuous Monitoring|Continuous Monitoring]], and [[wiki/Audit and Accountability|Audit and Accountability]]. - **reusable through:** [[wiki/Reciprocity (Information Assurance)|Reciprocity]]. - **IC policy:** [[wiki/ICD 503|ICD 503]]. ## Sources / Provenance - [NIST — SP 800-37 Rev. 2](https://csrc.nist.gov/pubs/sp/800/37/r2/final) - [ODNI — ICD 503](https://www.dni.gov/files/documents/ICD/ICD-503.pdf)