BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.9.1 Authorization to Operate (ATO) (was: Authorization to Operate)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 2 PREPARATION FOR ASSESSMENT AND AUTHORIZATION part of 2.9

Title changed

Before · SP 800-79-1

Authorization to Operate

After · SP 800-79-2

Authorization to Operate (ATO)

Control changed

Before · SP 800-79-1

If, after reviewing the results of the assessment phase, the DAA deems that the PCI and its facilities conform to FIPS 201-1 to an acceptable degree, and will continue to do so reliably during the accreditation validity period, an authorization to operate (ATO) may be issued. The PCI and its facilities are authorized to perform services in compliance with all relevant policies, in conformance to all relevant standards, and in accordance with the documented operations plan. The DAA shall indicate exactly which facilities are included in the ATO accreditation decision. An ATO can only be granted to a PCI if there are no limitations or restrictions imposed on any of its facilities that are included in the accreditation boundary.

After receiving an ATO under SP 800-79-1, re-accreditation shall be performed within three (3) years, or when there is a significant change in personnel or operating procedures (includes both improvement and degradation of operations) of a PCI, or when additional PCIFs are being added to a PCI. There may also be cases where one or more PCIFs cease operation. If this situation results in a PCI service identified in the PCI’s Operations Plan becoming unavailable, then the DAA must issue a Denial of Authorization to Operate (DATO- See Section 2.9.3). On the other hand On the other hand, if the PCI can continue to provide all services in the PCI’s Operations Plan, then the accreditation decision letter has to be modified to exclude those facilities that have ceased operations (thus revising the accreditation boundary). The required PCI re-accreditation activities are at the discretion of the DAA and based on the extent and type of change.

After · SP 800-79-2

If, after reviewing the results of the assessment phase, the DAADAO deems that the PCIoperations of the issuer and its facilities conform to control objectives of FIPS 201-1201-2 to an acceptable degree, and will continue to do so reliably during the accreditationauthorization validity period, an authorization to operate (ATO) may be issued. 12 The PCIissuer and its issuing facilities are authorized to perform services in compliance with all relevant policies, in conformance to all relevant standards, and in accordance with the documented operations plan. The DAADAO shall indicate exactly which issuing facilities are included in the ATO accreditationauthorization decision. An ATO can only be granted to aan PCIissuer if there are no limitations or restrictions imposed on any of its issuing facilities that are included in the accreditationauthorization boundary. The ATO is transmitted to the OIMO.

After receiving an ATO underthat conforms to SP 800-79-1800-79-2, re-accreditationre-authorization shall be performed within three (3) years, or when there is a significant change in personnel or operating procedures (includes both improvement and degradation of operations) ofor awhen additional issuing facilities

12 Note The PCI,/DPCI orATO whencan additionalbe PCIFsaffected by the underlying system authorization status (see Section 2.9.4 ). are being added to athe PCIissuer organization. There may also be cases where one or more PCIFsissuing facilities cease operation. If this situation results in a PCIPIV service identified in the PCI’s Operationsoperations Planplan becoming unavailable, then the DAADAO must issue a Denial of Authorization to Operate (DATO-DATO - See Section 2.9.3 ). On the other hand On the other hand, if the PCIissuer can continue to provide all services in the PCI’s Operationsoperations Planplan, then the accreditationauthorization decision letter has to be modified to exclude those issuing facilities that have ceased operations (thus revising the accreditationauthorization boundary). The required PCIre- re-accreditationauthorization activities are at the discretion of the DAADAO and based on the extent and type of change.