| name | executing-nist-rmf-authorization-to-operate |
| description | Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control baseline (FIPS 200 / SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and Monitor continuously. Use when a system needs an ATO or a renewal, when working a FISMA/FedRAMP authorization package, when building or reviewing an SSP, SAR, or POA&M, when categorizing a system as Low/Moderate/High impact, when selecting or tailoring a control baseline, or when standing up continuous monitoring (ConMon) after authorization. Covers ATO, conditional ATO (cATO), and the artifacts assessors expect. Keywords: NIST RMF, 800-37, ATO, authorization to operate, FISMA, FedRAMP, SSP, SAR, POA&M, FIPS 199, FIPS 200, 800-53, 800-53A, control baseline, security categorization, continuous monitoring, authorizing official, system boundary, ongoing authorization. |
| domain | cybersecurity |
| subdomain | compliance-governance |
| tags | ["nist-rmf","nist-800-37","ato","fisma","fedramp","nist-800-53","fips-199","ssp","poam","continuous-monitoring","governance"] |
| version | 1.0 |
| author | andrewibrah |
| license | Apache-2.0 |
| nist_csf | ["GV.OC-03","GV.RM-01","ID.AM-08","ID.RA-05","PR.IR-01"] |
| mitre_attack | ["T1078","T1190","T1068","T1210","T1486"] |
Executing the NIST RMF to an Authorization to Operate (ATO)
When to Use
- When a federal or federally-aligned system (or a FedRAMP cloud service) needs an Authorization to Operate, a re-authorization, or has fallen out of authorization.
- When you must produce or review the core authorization artifacts: System Security Plan (SSP), Security Assessment Report (SAR), and Plan of Action & Milestones (POA&M).
- When categorizing a system's impact level (Low / Moderate / High) under FIPS 199.
- When selecting, tailoring, or implementing a NIST SP 800-53 Rev 5 control baseline.
- When standing up continuous monitoring (ConMon) or pursuing ongoing authorization / cATO after an initial ATO.
Prerequisites
- A defined system and authorization boundary (what's in, what's inherited, what's a leveraged service).
- An identified Authorizing Official (AO), System Owner, and ISSO.
- The information types the system handles (use SP 800-60 to map them to impact levels).
- For cloud: the provider's Customer Responsibility Matrix (CRM) and any inherited/leveraged ATO.
- Access to assessment evidence sources (config, scans, policies) for the Assess step.
Workflow
NIST SP 800-37 Rev 2 defines seven steps. Prepare is the foundation; the rest run in order and then loop through Monitor.
0/1. Prepare (organization and system level)
Establish context: roles (AO, SO, ISSO, assessor), risk-management strategy and tolerance (ties to SP 800-39), a control baseline strategy, common controls available for inheritance, and the system's mission/business context. Define the authorization boundary precisely — scope creep here inflates the whole package.
2. Categorize (FIPS 199 + SP 800-60)
Determine the impact level for confidentiality, integrity, and availability for each information type, then take the high-water mark across the three to set the overall system categorization: Low, Moderate, or High. Document in the SSP. This single decision drives the entire control baseline.
3. Select (FIPS 200 + SP 800-53 Rev 5 + SP 800-53B)
Start from the SP 800-53B baseline matching the categorization (Low/Moderate/High). Then : apply scoping guidance, select compensating controls where needed, and assign values to organization-defined parameters. Add overlays (e.g., privacy, FedRAMP). Record the tailored set and the rationale in the SSP. Identify which controls are , , or .
