Why ATOs Suck
from "This Is Fine" with Hunter Strategy Hosted by Hunter Strategy
The Authority to Operate (ATO) process is meant to show that a federal system is secure enough to run. In practice it’s usually months of checklists, interpretation, and debate with assessors. Matt talks with Chris Sowers, CEO of Watchtower Security Consultants, about why ATOs are so hard: governance lags behind technology, agencies interpret the same rules differently, and vendors get caught between FedRAMP, impact levels, and their customers’ expectations. They also cover how to get through it anyway. Chapters 00:00 Intro 00:34 Matt sets up the episode and introduces Chris 01:18 An ATO explained as a yearly car registration 03:09 California vs. Michigan: which agencies have the strictest ATOs 05:30 SolarWinds and how public scrutiny shapes security posture 06:02 FISMA’s ambiguity and why governance can’t keep pace with cloud 07:54 Not applicable vs. non-compliant: the MongoDB Community Edition example 11:01 Mitigating controls and alternate implementations 12:44 Working with assessors: honesty, education, and trust 14:36 Advice for a company facing its first ATO 17:14 On-prem software in the stack: NIST 800-161, 800-171, and ITAR 19:25 Why impact levels apply to cloud offerings, not software 20:27 DocuSign vs. Salesforce: the gap in how agencies use FedRAMP 21:55 Customer responsibility matrices and transitive trust 26:26 The Jira-on-EC2 workaround 29:45 How agency sponsorship speeds up FedRAMP authorization 30:43 Wrap-up 31:00 Outro
Embed this episode
No transcript yet.