It is often used in the federal government for information technology. For example, before a software program can be installed by employees on a network, that program may require an ATO. The body that issues the ATO certifies that the product or service works with existing systems.

What is an interim ATO?

Definition(s): Temporary authorization granted by principal accrediting authority (PAA) or authorizing official (AO) for an information system to process information based on preliminary results of a security evaluation of the system.

What is a SAR in RMF?

In Step 5 of the RMF process, the AO is presented with an Authorization Package that contains, at a minimum, a System Security Plan (SSP), a Security Assessment Report (SAR) and a Plan of Action & Milestones (POA&M). … The AO will then analyze the risk posture of the system, as indicated by these documents.