Authority to Operate (ATO) for SaaS Companies: What It Is and How Agencies Grant One

2026-10-09#fedramp #compliance #saas #federal-market

By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.

Sooner or later, every software company selling to an agency hears the same question from the program office: “Do you have an ATO?” Founders often answer with whatever compliance credential they have on hand, such as SOC 2, ISO 27001 or a security questionnaire. None of them answers the question.

An Authority to Operate (ATO) is not a certificate your company earns. It is a decision an agency makes about your system, signed by a named federal official. This guide explains what that decision is, who makes it, how it relates to FedRAMP, and what has to be in place before anyone can sign it.

What an ATO actually is

An ATO is a formal, signed decision that a specific system may operate with government data, in a specific configuration, for a specific use. The official who signs it, the Authorizing Official, accepts the remaining security risk on the agency’s behalf.

That one fact explains most of the process:

It is issued by the government, not by you. A vendor cannot obtain an ATO by passing a test. It can only produce the evidence that lets an official decide.
It is specific. An ATO covers a defined system used a defined way. An authorization one agency grants for one use doesn’t automatically carry over to a different agency or a different kind of data.
It is personal. A named official puts their accountability behind the decision. That’s why agencies are careful about which systems they authorize, and why finding an agency willing to start the process has historically been hard.

The process behind most federal ATOs comes from the NIST Risk Management Framework: categorize the system, select and implement controls, assess them, authorize, and then monitor continuously.

ATO vs. FedRAMP

These two get confused more than any other pair of terms in federal software sales.

FedRAMP is the government-wide program that standardizes how cloud services are assessed, so that the evidence can be reused. An ATO is the authorization decision an individual agency makes.

FedRAMP exists so that one body of assessment evidence can support many agency ATOs. Once a cloud service holds a FedRAMP authorization, another agency can review the existing package and issue its own ATO without repeating the full assessment. This reuse, known as reciprocity, is the main economic argument for FedRAMP.

Reciprocity is real but not automatic. The second agency still reviews the package against its own risk tolerance, and it can add conditions or require additional controls for its use.

For a SaaS company the practical point is this: agencies generally expect cloud services they use to go through FedRAMP. An agency-only ATO with no FedRAMP authorization behind it may get you into one buyer, but it doesn’t travel the way a FedRAMP package does. FedRAMP 20x is changing how that path works. Our guides to the FedRAMP 20x timeline and Class A readiness cover the current routes.

What has to exist before anyone can sign

An Authorizing Official reads risk, not marketing. Before a decision is possible, three things need to exist.

1. A defined system

The authorization boundary sets out what is inside the system being authorized, what is outside it, and where data crosses the edge. Every third-party service your product depends on, including hosting, identity, email, logging and support tooling, has to be accounted for on one side of that line or the other.

Boundary decisions drive cost. Products with a tight, well-understood architecture produce smaller, faster packages. A boundary drawn around “the whole company” produces an assessment nobody can finish.

2. Implemented and documented controls

The security controls required at your system’s impact level have to be in place and described, usually in a system security plan. The impact level, whether Low, Moderate or High, depends on the data the agency intends to put in the system and on what harm its exposure would cause. Building for the wrong level is expensive in either direction, so confirm it with your buyer before you start.

3. An independent assessment

Someone other than you tests whether the controls work as described. For FedRAMP that is an accredited third-party assessment organization (3PAO). The assessment produces a report of findings, and anything still open goes onto a plan of action and milestones (POA&M) with remediation dates.

With those in hand, the official reviews the package and makes the decision. An authorization can be granted with conditions, meaning it is valid, but the open POA&M items have deadlines that matter.

Self-attested is not authorized

This is where many SaaS companies lose credibility in a first federal meeting.

A security questionnaire you completed, a trust page you published, or a statement that you’re “aligned with NIST 800-53” is self-attested. It tells a buyer what you say about yourself. An ATO or a FedRAMP authorization is a decision by a government official, based on an independent assessment, and for FedRAMP it is recorded where anyone can check it.

Buyers treat these very differently, and they should. When a program office asks about your ATO status, answer precisely: what you hold, who assessed it, and what remains open. “We’re SOC 2 Type II and pursuing FedRAMP” is an honest answer. “We’re basically FedRAMP-ready” invites a follow-up question you can’t answer well. We cover this distinction in more depth in verified vs. self-attested compliance.

An ATO is something you keep, not something you file

Authorization doesn’t end at the signature. Keeping an ATO means continuous monitoring: regular vulnerability scanning, periodic reporting to the agency, notifying it before significant changes to the system, and recurring assessment activity. Traditionally an authorization was revisited on a fixed cycle. More agencies now refresh the decision on an ongoing basis from monitoring data.

Systems lose authorizations more often by letting monitoring lapse than by failing the first assessment. Plan for it as a permanent operating cost with named owners, not as a project with an end date.

Questions to answer before you start

Which agency, which program, which data? An ATO is always for a specific system used a specific way. An effort with no buyer in view has no natural finish line.
What impact level? Confirm it with the program office, in writing if you can.
Who will sponsor or accept the package? Know whether you’re pursuing an agency authorization, a FedRAMP path that doesn’t require a sponsor, or reuse of an existing package by a new agency.
What is inside your boundary today? List every external service your product touches before an assessor does it for you.
Who owns continuous monitoring? Name the people before you sign anything.

If you sell to the Department of War, the authorization picture has more layers, and work involving CUI can also bring CMMC requirements on your company. Our DoW compliance calendar lays out the dates.

See where you stand

An ATO is one part of what a federal buyer checks. The free GovExpress Target Finder shows which agencies buy in your category, using public USAspending data. To see how your compliance posture reads alongside the other categories buyers look at, score your company’s federal readiness.

The CMMC brief

What the Phase 2 suspension changed and what it did not — the obligations that still bind, the assessment path a contract puts you on, the scoping decision that drives the cost, and the sequence that fits inside a pipeline. Sourced from the primary record.