ProcessAerospace & Defense

Getting an ATO for an AI system: the Risk Management Framework step by step

An Authority to Operate is a named official's decision to accept the residual risk of running a system. Machine learning adds components the usual package does not describe well: training pipelines, datasets of uncertain origin, models that change when retrained. This page walks the Risk Management Framework steps, shows the AI evidence each one needs, and explains how drift monitoring leads toward continuous authorization.

Reviewed 7 min read

On this page
  1. What an ATO is and why AI components complicate it
  2. The RMF steps as a continuing loop
  3. Each RMF step and the AI evidence it needs
  4. The AI evidence pack assessors increasingly expect
  5. Contractor obligations that sit beside the ATO
  6. UK programs: MOD Secure by Design in place of accreditation
  7. An aircraft predictive-maintenance model moves toward authorization
  8. Questions and answers
  9. Sources

What an ATO is and why AI components complicate it

In US defense programs, an Authority to Operate is granted by an Authorizing Official (AO): a senior official who reviews the security posture of a system and formally accepts the risk that remains. The process behind that decision is the Risk Management Framework defined in NIST SP 800-37 Revision 21 and applied to DoD systems by DoD Instruction 8510.012.

Conventional software is relatively easy to describe to an assessor: source code, dependencies, configuration and infrastructure. An AI system adds three things. Its behavior depends on data that may come from many places with weak provenance. Its core component, the model, is opaque to code review. And it changes in a way ordinary software does not: retraining produces a new model with new behavior from the same code.

None of this needs a separate process. It needs the familiar steps to be applied to more of the system, and an evidence pack that answers the questions assessors now ask about data, models and human oversight.

The RMF steps as a continuing loop

01Prepare02Categorize03Select04Implement05Assess06Authorize07Monitor
  1. Prepare

    Roles, risk tolerance and an inventory that includes models and datasets.

  2. Categorize

    Set the boundary and rate the impact of a compromise.

  3. Select

    Choose and tailor the control baseline.

  4. Implement

    Build the controls and document how each is met.

  5. Assess

    Independent testing of controls, including AI-specific attacks.

  6. Authorize

    The AO accepts residual risk, with conditions and open items.

  7. Monitor

    Ongoing control and model monitoring that feeds the next cycle.

Conceptual view of the Risk Management Framework as a cycle. Monitoring feeds back into preparation; it does not show durations.

Each RMF step and the AI evidence it needs

  1. Prepare

    Name the AO, the system owner and whoever owns the training pipeline. Agree the risk tolerance for the mission, list common controls inherited from the hosting environment, and build an inventory that treats models, datasets and labeling tools as assets in their own right.

    Output
    Roles, risk strategy and asset inventory
    Owner
    System owner with the AO's staff

  2. Categorize

    Draw the boundary to include data ingestion, labeling, training, the model registry and inference. Rate the impact of a compromise using FIPS 1993; DoD systems use CNSSI 1253, which rates confidentiality, integrity and availability separately2. Integrity often rates high for AI, because poisoned data corrupts every later decision.

    Output
    Categorization and boundary diagram
    Owner
    System owner and security lead

  3. Select

    Start from the NIST SP 800-53 baseline for the categorization and tailor it with applicable overlays4. For AI, the supply chain risk management family covers pretrained models and third-party datasets, configuration management covers models and thresholds, and audit covers access to training data and inference logs.

    Output
    Control allocation and security plan
    Owner
    Security architect

  4. Implement

    Build the controls into the pipeline rather than around it: signed model artifacts in a registry, lineage recorded for every dataset, pinned dependencies, and a software bill of materials that lists models and datasets alongside libraries. Document how each control is met in terms an assessor can test.

    Output
    Implemented controls and evidence references
    Owner
    Engineering team

  5. Assess

    The assessor tests the controls and reviews the AI evidence pack. Expect scenario testing for evasion, data poisoning and, for language-model components, prompt injection, using a shared vocabulary such as the NIST adversarial machine learning taxonomy6. Findings feed the assessment report rather than being fixed quietly.

    Output
    Security assessment report
    Owner
    Independent assessor

  6. Authorize

    The AO weighs residual risk against mission need. Open findings go into a plan of action and milestones (POA&M) with owners and dates. AI systems often receive conditions of use, such as human review of every output above a set consequence or a restriction on which data classes the model may process.

    Output
    Authorization decision, POA&M and conditions
    Owner
    Authorizing Official

  7. Monitor

    Run a continuous monitoring strategy that covers model behavior as well as controls: input drift, output distribution, error rates on reviewed cases and incidents. Route each retraining through change control with a defined evaluation gate, so the authorized system and the running system stay the same thing.

    Output
    Monitoring reports and updated POA&M
    Owner
    System owner and operations

The AI evidence pack assessors increasingly expect

Aligning the pack with the DoD AI Ethical Principles (responsible, equitable, traceable, reliable and governable) gives assessors a familiar structure5.

0 of 9 checked

Contractor obligations that sit beside the ATO

A contractor building an AI system for DoD usually meets these obligations on its own networks at the same time as the government system pursues its ATO.

ObligationWhat it coversHow it relates to the ATO
System ATO under DoDI 8510.01The government system being fielded, assessed through the RMF2This is the authorization itself
DFARS 252.204-7012Safeguarding covered defense information on contractor systems and rapidly reporting cyber incidents, defined as within 72 hours of discovery8Protects the training data and code on the contractor's side before delivery
NIST SP 800-171The security requirements for controlled unclassified information on contractor systems; DoD continues to assess against Revision 210Covers the development environment, not the fielded system
CMMCPhase 1 began on November 10, 2025, allowing contracts to require Level 1 or Level 2 self-assessments9; Phase 2 third-party certification was suspended in July 2026 pending a review10A condition of contract award, separate from system authorization; check current status before bidding

CMMC timing has changed more than once; confirm the current phase with the contracting officer and the DoD CIO before relying on this table.

UK programs: MOD Secure by Design in place of accreditation

An aircraft predictive-maintenance model moves toward authorization

Questions and answers

Does every model retraining need a new ATO?

Not usually. If the authorization defines retraining as a controlled change, with an evaluation gate, documented thresholds and records, a retrained model can be deployed within the existing authorization. A change that alters the system boundary, the data classes processed or the model's purpose is different: it normally goes back to the AO for a new decision.

Can an AI system get a continuous ATO?

Potentially. DoD's continuous authorization memo expects ongoing visibility of controls within the boundary, the ability to carry out active cyber defense and use of an approved DevSecOps reference design7. An AI system adds model monitoring and controlled retraining to those conditions. Systems normally reach continuous authorization after holding a conventional ATO and proving their monitoring works.

Who should own the AI evidence pack?

The system owner is accountable, but the evidence comes from the engineering team that trains and evaluates the model. In practice, a named machine-learning lead maintains lineage, model documentation and evaluation results, and the security lead maps them to the controls the assessor will test. Assigning this early avoids reconstructing evidence after the build is finished.

How early should RMF work start on an AI project?

At design, before the first training run. Boundary decisions, dataset approvals and logging choices are cheap to make early and expensive to retrofit. Projects that treat the ATO as a final hurdle often discover that training data lacks provenance or that the pipeline cannot show who accessed what, and then have to rebuild parts of it.

Sources

  1. NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations — National Institute of Standards and Technology · checked 10 October 2026
  2. DoD Instruction 8510.01, Risk Management Framework for DoD Systems — US Department of Defense, Executive Services Directorate · checked 10 October 2026
  3. FIPS 199, Standards for Security Categorization of Federal Information and Information Systems — National Institute of Standards and Technology · checked 10 October 2026
  4. NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations — National Institute of Standards and Technology · checked 10 October 2026
  5. Department of Defense Responsible Artificial Intelligence Strategy and Implementation Pathway — US Department of Defense · checked 10 October 2026
  6. NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — National Institute of Standards and Technology · checked 10 October 2026
  7. Continuous Authorization to Operate (cATO) memorandum — DoD Chief Information Officer · checked 10 October 2026
  8. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting — Acquisition.gov · checked 10 October 2026
  9. DoD Releases Long-Awaited Final Rule Implementing Cybersecurity Maturity Model Certification Contract Clause — Cooley LLP · checked 10 October 2026
  10. DOW Suspends CMMC Phase II Requirements — Holland & Knight · checked 10 October 2026
  11. Industry Security Notice 2023/09: Secure by Design Requirements — UK Ministry of Defence · checked 10 October 2026

More in Aerospace & Defense

Back to Aerospace & Defense

Next step

Share your system boundary and we will list the AI evidence it needs

Send a diagram of the system you plan to authorize and where its models are trained. We will reply with the evidence each RMF step will ask for and the gaps worth closing before the assessor arrives.

Plan an AI authorization