Welcome back . My name is kelly Kernen
and I'm here representing the
Department of the Air Force Chief
Information security officer and a
fireworks . This is number five in the
blue cyber series fast track in
our discussion today , we're going to
be talking about a todos or
authorization to operate . Let me
explain . And A T . O . Is the official
management decision given by a senior
organizational official to authorize
operation of an information system and
to explicitly accept the risk to
organizational operations ,
organizational assets , individuals ,
other organizations and the nation
based upon the implementation of an
agreed upon set of security controls .
A todos often have conditions and
assumptions which must be continually
monitored by the program office which
applied for the A . T . O . A fast
track . A T . O is based upon a
cybersecurity baseline , a threat risk
assessment and an information system ,
continuous monitoring strategy . These
three factors allow for a risk based
decision on an A T . O . Let's back
up and talk about risk management
framework or RMF . The RMF is a
criteria that describes the processes
for architecture , security and
monitoring of U . S . Government I . T .
Systems . The RMF was
created by the Department of Defense in
2010 . It has been documented by Nist
and serves as the foundation for
federal data security strategy . The
RMF requires secure data governance
strategies and the performance of cyber
risk modeling to identify cyber risk
threat areas . The fast track 80 oh
accelerates RMF steps , select through
authorized . It does this by focusing
on operationally relevant risk
identification and threatened formed
risk assessments for Department of the
Air Force systems and missions . What
this means practically is that if there
are items of low risk that are not
quite secure and A . T . O . Can be
issued with a due date for those items
to become secure . You might be
wondering how do I get an ATO Again ?
An eight EO is a relationship between a
Department of the Air Force program
office and an authorizing official .
The program office is a Department of
the Air Force Program of Record which
has the leadership and resources such
as cybersecurity resources which can
accept and manage the risks outlined in
the patio . You might be wondering
where does the vendor come in ? The
vendor comes in when they complete the
AO determination briefing . That
briefing is a set of slides where the
vendor describes comprehensively their
I . T . And the risk to operations .
How does the process begin ? The
process begins when an airman or
guardian decides to acquire a vendor's
I . T . They go then to their program
office and inquire about how to begin
if there is no program office , go to
the wing cybersecurity office to begin .
Thanks for spending time with me during
this discussion today Today we talked
about the fast track 80 Oh and how to
begin the process a reminder that this
presentation is not a substitute for
reading the far and deforest in your
small business contract . My name is
kelly Kernen and I'm here representing
the Department of the Air Force , Chief
Information Security Officer , and it
works .