Continuous ATO (cATO): Authorization That Never Expires

A traditional ATO is a snapshot: months of effort producing an authorization that starts aging the day it's signed. Continuous ATO (cATO) replaces the snapshot with a live feed — a system whose security posture is monitored, evidenced, and reported continuously, so authorization doesn't expire; it persists as long as the posture holds.

What an AO requires for cATO

Guidance across DoD converges on three pillars: continuous monitoring of the control baseline (not quarterly scans — live dashboards on the controls that matter), active cyber defense — the ability to detect and respond in something like real time, and a secure software supply chain — hardened pipelines, signed artifacts, SBOMs, and gates that block what fails policy. In other words: DevSecOps wired straight to the authorization boundary.

The unglamorous work that makes it real

Controls as code. Baselines applied by automation (not wiki pages), drift detected the hour it happens, evidence generated as a byproduct of operations rather than a quarterly scramble.

A living POA&M. Findings flow from scanners into tracked remediation automatically; burn-down is visible to the AO without anyone assembling a briefing.

Dashboards the AO trusts. The cultural shift is the hard part: the AO stops consuming documents and starts consuming telemetry. Earning that trust takes clean data lineage — every number traceable to the system that produced it.

This is the exact intersection where we build — RMF discipline, platform automation (including ServiceNow-based ConMon), and pipelines that treat compliance as an output of engineering. The prize is real: field changes in days on an authorization that doesn't expire.

Common questions

What is a continuous ATO (cATO)?

An authorization sustained by continuous monitoring rather than by periodic reassessment. Instead of a package assembled every three years, the system reports its security posture continuously, and the authorization persists for as long as that posture holds. The authorizing official is still making a risk decision — they are just making it against current evidence instead of a snapshot that started aging the day it was signed.

What does an authorizing official require before granting cATO?

DoD guidance converges on three pillars. Continuous monitoring of the control baseline, meaning live reporting on the controls that matter rather than quarterly scan results. Active cyber defense, meaning the ability to detect and respond in something close to real time. And a secure software supply chain — hardened pipelines, signed artifacts, an SBOM, and gates that stop what fails policy. All three have to be demonstrable, not asserted.

Is cATO the same as ongoing authorization?

They overlap. Ongoing authorization is the RMF’s own term for making authorization decisions from continuous monitoring output instead of a fixed three-year cycle. cATO is the DoD framing of the same idea, and it adds explicit expectations about active defense and the delivery pipeline. The difference is emphasis, not conflict — a program that satisfies the cATO pillars is operating under ongoing authorization.

cATO: the ATO that never expires — if you earn it.

What an AO requires for cATO

The unglamorous work that makes it real

Common questions

Related reading

Need it done, not just explained?