authorization to operate

{
  "id": "MLC-T-CYB-000347",
  "term": "authorization to operate",
  "field": "Cybersecurity",
  "definition": "1. Official management decision given by a senior Federal official or officials to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security and privacy controls. Authorization also applies to common controls inherited by agency information systems. Note 1: The system is authorized to operate for a specified period in accordance with terms and conditions established by the authorizing official. Note 2: Formerly known as \"approval to operate.\" Term was replaced in the risk management framework in 2010.\n\n2. Formal recognition that a laboratory is competent to carry out specific tests or calibrations or types of tests or calibrations.\n\n3. See Authorization (to operate).\n\n4. Authorization to Operate; One of three possible decisions concerning an issuer made by a Designated Authorizing Official after all assessment activities have been performed stating that the issuer is authorized to perform specific PIV Card and/or Derived Credential issuance services.",
  "abbreviation": "accreditation",
  "synonyms": [
    "approval to operate",
    "ATO",
    "security authorization (to operate)",
    "Security Authorization(to Operate)"
  ],
  "references": [
    "CNSSI 4009-2022 from OMB Circular A-130 (2016); NIST SP 800-161r1-upd1 [11/1/2024 errata update] from NIST SP 800-53 Rev. 5; NIST SP 800-37 Rev. 2 from OMB Circular A-130 (2016); NIST SP 800-53 Rev. 5 from OMB Circular A-130 (2016); NIST SP 800-53A Rev. 5 from OMB Circular A-130 (2016)",
    "CNSSI 4009-2022 from NIST HB 150-2016, NVLAP",
    "NIST SP 800-30 Rev. 1; NIST SP 800-39",
    "NIST SP 800-79-2",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/authorization-to-operate/"
}