What is Continuous Authorization to Operate (cATO)?

Question

Accepted Answer

A rigorous, evolving ATO based on supply-chain cyber survivability, driven by real-time metrics — cATO is a more rigorous, evolving ATO predicated on cyber survivability posture across the entire software supply chain and driven by real-time metrics gathered at every step — not a one-time ATO, a waiver, or an informal sign-off.

Answer

A one-time authorization that is granted at launch and then never revisited afterward

Answer

A waiver that simply exempts a system from any authorization requirements at all

Answer

An informal sign-off that is given verbally by the development team's own lead engineer

What is Continuous Authorization to Operate (cATO)?

Why this is the answer

More DevSecOps flashcards