ATO

{
  "id": "MLC-T-CYB-000277",
  "term": "ATO",
  "field": "Cybersecurity",
  "definition": "1. The official management decision issued by a designated accrediting authority (DAA) or principal accrediting authority (PAA) to authorize operation of an information system and to explicitly accept the residual risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals.\n\n2. seeCertificationandAccreditation.\n\n3. Authorization to Operate; One of three possible decisions concerning an issuer made by a Designated Authorizing Official after all assessment activities have been performed stating that the issuer is authorized to perform specific PIV Card and/or Derived Credential issuance services.",
  "expansions": [
    "Air Traffic Organization",
    "approval to operate",
    "Authority to Operate",
    "Authorization to Operate"
  ],
  "references": [
    "CNSSI 4009-2015",
    "NIST SP 800-16",
    "NIST SP 800-79-2",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/ato/"
}