Continuous ATO in plain language.

The short version

An authorization to operate (ATO) is a senior official's formal decision that a system's risk is acceptable. Traditionally that decision was renewed every few years, after a large package of evidence was assembled by hand. A continuous ATO keeps the decision current instead, because the evidence behind it is monitored and refreshed all the time.

Continuous ATO does not skip the first authorization. A system still earns its initial ATO. What changes is what happens afterward.

Where it comes from

The idea is built into the federal Risk Management Framework. National Institute of Standards and Technology (NIST) SP 800-37 Revision 2 treats continuous monitoring as a step in the system life cycle and supports ongoing authorization, where risk decisions are made on current information. NIST SP 800-137 describes how an organization sets up that continuous monitoring, including how often each control is assessed.

The Department of Defense made the term common. A February 2022 DoD CIO memorandum described continuous authorization as an emphasis on the monitoring step of the framework, and said an Authorizing Official must be able to show strong, ongoing competencies before a system qualifies. The DevSecOps Continuous Authorization Implementation Guide later set out the detailed requirements.

What an Authorizing Official needs to see

• Current evidence for every control. Not a snapshot from the last assessment, but evidence with a known date, so stale items are visible.
• Open weaknesses tracked to closure. A live Plan of Action and Milestones with owners and due dates.
• Evidence that can be trusted. Records that show who produced them and that they have not been changed since.
• Secure software practices. Changes that move through a pipeline with security checks built in, so new releases do not reset the risk picture.

What it is not

• It is not a tool you buy. No product grants an ATO; the Authorizing Official does.
• It is not less scrutiny. It is more frequent scrutiny, made affordable by automation.
• It is not only for the Department of Defense. Civilian agencies use the same framework and the same monitoring guidance.

Where our products fit

Vigil links each control to its evidence and scores coverage and freshness. DevSecOps Evidence Builder turns each software release into signed evidence. Both produce material for the Authorizing Official to review. Neither replaces the initial ATO, and neither holds an authorization of its own.