Module 6 Authorization and the ATO Package
What you will be able to do
- List the contents of an authorization package and check one for completeness and consistency.
- Explain what the authorizing official decides, the decision options, and why risk acceptance must be explicit.
- Write a residual risk statement with compensating measures.
- Explain conditional and interim authorizations and when each is appropriate.
- Identify the most common reasons packages fail.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. The Authorization Package and the Decision · 35 min Completed
- 2. Determining and Accepting Risk · 40 min Completed
- 3. Kinds of Decision: Authorizations, Conditions, and Denials · 40 min Completed
- 4. Ten Ways Authorization Packages Fail · 35 min Completed
- 5. After the Signature · 30 min Completed
Practice and quiz
- Practical exercise: An ATO on a Page and a Decision Brief for TreasuryFlow
- Module quiz (10 questions, pass mark 80 percent)
Overview
The security plan is written, the assessment is done, and the open weaknesses are listed. This module covers the Authorize step of the Risk Management Framework: assembling those into a package, turning findings into a statement of risk, and the decision itself, with its variants and conditions.
The Information System Security Officer (ISSO) does not make the decision. The ISSO does most of the work that makes a sound decision possible, and carries the conditions afterward. The recurring theme is honesty: the authorizing official is entitled to the real position, stated plainly.
Builds on
- Module 5, Lessons 4 and 5: findings and the assessment report, which become the raw material for risk statements.
- Module 4: the security plan, the first document in the package.
- Module 2, Lesson 4: categorization set threat aside. Here threat and likelihood come back in.
- Module 1, Lesson 3: the authorizing official, who alone can accept risk.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | The Authorization Package and the Decision | 35 min | Adapted from existing material |
| 2 | Determining and Accepting Risk | 40 min | Adapted |
| 3 | Kinds of Decision: Authorizations, Conditions, and Denials | 40 min | Adapted |
| 4 | Ten Ways Authorization Packages Fail | 35 min | Adapted |
| 5 | After the Signature | 30 min | New |
What is binding here, and what is guidance
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| FISMA | Binding statute | Makes agency heads responsible and requires risk-based protection |
| OMB Circular A-130 | Binding policy | Requires systems to be authorized by a senior official before operating, and permits ongoing authorization |
| NIST SP 800-37 (Authorize step; decision types) | Guidance, required in practice | Applied through Circular A-130 |
| NIST SP 800-39, SP 800-30 | Guidance | Risk management and risk assessment methods |
| NIST SP 800-53, control CA-6 | Guidance, required in practice | Selected in every baseline |
| Agency risk tolerance | Binding within the agency | Set at the organization level |
| Agency authorization policy and templates | Binding within the agency | Defines the required package contents and local terms |
| "Interim authorization to test," "conditional ATO" | Agency practice | Widely used terms that are not NIST decision types as such; meaning is set by agency policy |
| Three-year reauthorization cycle | Agency policy where used | Not a universal federal rule |
| The signed authorization decision and its conditions | Binding on the system | It is the official's direction |
Module summary
- The package is the security plan, the assessment report, the plan of action and milestones, and an executive summary, with supporting documents as agency policy requires.
- Complete is not enough. The documents must agree with one another; run the consistency links before submitting.
- Findings are not risk. Risk says what could happen, how likely, and how much it would matter, taking other controls into account.
- Risk is accepted only by the authorizing official, explicitly, in a signed decision. Running the system, listing a weakness, or silence is not acceptance.
- A residual risk statement names the gap, the possible consequence, what reduces it, and what remains.
- NIST guidance describes authorization to operate, common control authorization, authorization to use, and denial. Conditions make an authorization "yes, provided that." Use the instrument that fits.
- Packages fail in ten predictable ways, nearly all preventable long before the Authorize step.
- After the signature, track the conditions, watch the dates, and keep the official informed.
What comes next
Module 7 covers the longest step: continuous monitoring, managing change, and running the plan of action and milestones so that the authorization stays true.
Last reviewed 2026-11-11. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.