Rutledge & Associates - Prime Ready SubcontractorsVisit Website →
← Back to blog

Cut DoD Authorization to 90 Days: Five Phase Continuous ATO Roadmap

September 1, 2026
Cut DoD Authorization to 90 Days: Five Phase Continuous ATO Roadmap

Continuous Authorization to Operate (cATO) is a dashboard-driven, continuously validated authorization model that lets an Authorizing Official keep a system authorized as long as live, machine-readable evidence meets defined risk thresholds. Instead of a triennial paperwork cycle, the AO watches real-time telemetry: automated control validation, continuous monitoring feeds, and active cyber defense signals. Authorization holds only as long as that evidence stream stays healthy.

TL;DR:

  • Achieving cATO relies on automated, real-time data feeds for continuous monitoring and a dashboard that provides queryable control evidence, not static reports.
  • The successful implementation of cATO requires a secure pipeline foundation, machine-readable documentation using OSCAL, and active cyber defense integration.
  • The formal authorization process can be shortened from 6 to 18 months to around 90 days if the system already has a mature DevSecOps foundation and OSCAL automation.
  • Maintaining cATO depends on stringent SLAs for dashboard uptime, patching, and data freshness, with revocation triggered by any significant lapse or missing remediation deadlines.
  • Prioritizing the full evidence chain, including provenance, SBOM, and runtime telemetry, is critical, as shortcuts like container-only scanning lead to assessor pushback and loss of trust.

Table of Contents

What Is Continuous ATO and How Does It Differ From a Traditional ATO?

A traditional Risk Management Framework ATO is a snapshot. An assessor validates controls, an AO signs off, and the authorization sits fixed for up to three years while the system underneath keeps changing. Continuous ATO replaces that snapshot with a live feed. Under the DoD CIO's cATO memorandum, authorization has no fixed expiration date. It persists as long as the required real-time risk posture holds, and it can be revoked the moment that posture degrades.

The model still runs on NIST SP 800-37 Rev. 2, which already treats continuous monitoring as a formal RMF step. cATO operationalizes that step instead of treating it as an afterthought. A few terms come up constantly in this world:

  • CONMON: continuous monitoring, the ongoing collection of security telemetry against assigned controls.
  • OSCAL: the Open Security Controls Assessment Language, used to make compliance documentation machine-readable.
  • SBOM: a software bill of materials, listing every component in a build.
  • DevSecOps: security embedded directly into the CI/CD pipeline rather than bolted on afterward.

Why Does Continuous ATO Matter for Federal Programs?

The math on the old model is brutal. Reauthorization cycles eat months of staff time reassembling evidence that was already true six months earlier. cATO automation collapses that overhead by keeping the evidence current at all times, so there's nothing to reassemble.

The benefits show up in three places:

  • Speed: mature programs can move from code commit to authorized deployment without waiting on a fresh point-in-time assessment.
  • Drift reduction: because the dashboard reflects the system's actual state, gaps between "authorized configuration" and "deployed configuration" shrink dramatically.
  • Policy alignment: cATO puts programs in step with DoD CIO direction and the broader federal push toward NIST- and OMB-aligned continuous assurance.

Pro Tip: Don't sell cATO to leadership as a compliance project. Sell it as a delivery-speed project with compliance as the side effect. That framing gets budget approved faster.

A GAO-cited multi-agency review puts average traditional ATO timelines at 6 to 18 months, with FedRAMP authorizations running 12 to 24 months. Mature cATO programs compress the formal authorization phase to roughly 90 days once the DevSecOps foundation is in place.

Comparison of traditional and continuous ATO timelines

What Are the DoD's Three Pillars for cATO Evaluation?

The DoD CIO evaluation criteria require three demonstrated competencies before an AO will even consider a cATO request. Think of these as the checklist an assessor actually works from.

  1. Continuous monitoring (CONMON). The program needs a live dashboard, automated data feeds mapped to specific controls, and agreed SLAs for how fresh that data has to be. Stale feeds are treated the same as missing feeds.
  2. Active cyber defense. This means integration with a Cybersecurity Service Provider (CSSP), a defined testing cadence, and demonstrated response capability, not just a written incident response plan sitting in a binder.
  3. Secure software supply chain and DevSecOps. Pipelines need enforced gates (no merge without passing scans), build provenance, and alignment with supply chain security concepts like SLSA, expressed through OSCAL-formatted evidence.

What satisfies each pillar in practice:

  • Dashboards that show control family status at a glance with drill-down to source evidence.
  • CSSP contracts naming response time commitments, not aspirational language.
  • OSCAL packages generated automatically from pipeline output, not narrative Word documents assembled by hand.

Assessors consistently flag one failure mode above all others: evidence that exists but isn't queryable. A scan result buried in a log file is not the same as a scan result mapped to a control in a dashboard.

How Do You Implement Continuous ATO Step by Step?

Agencies that get this right treat cATO as a five-phase build, not a one-time submission. The phases run in sequence, and skipping ahead almost always creates rework later.

  1. Phase 0: Preconditions. Get an honest read on your current ATO health. Clear outstanding High findings first. Get written leadership and AO buy-in before writing a line of pipeline code, because cATO fails without an AO who trusts the model.
  2. Phase 1: Pipeline and secure landing zone. Build in SAST, SCA, DAST, secrets detection, and artifact signing as pipeline gates. This is the mechanical backbone everything else depends on.
  3. Phase 2: Machine-readable documentation. Convert control documentation into OSCAL and map each automated tool's output directly to the control it validates. Narrative documents don't feed a compliance engine; structured data does.
  4. Phase 3: Operationalize the dashboard. Stand up CONMON dashboards with automated alerting, give the AO direct read-only access, and set SLAs for data freshness and remediation timing.
  5. Phase 4: Formal submission and maintenance. Submit the cATO request, complete independent testing, and lock in a maintenance plan for what happens after approval, since approval is the start of the obligation, not the end.

Pro Tip: Pick your first cATO candidate system carefully. A system with short release cycles and a small blast radius proves the model fast without putting a mission-critical workload at risk during the learning curve.

Total buildout typically runs 6 to 18 months. The formal authorization window itself can compress to around 90 days for programs that arrive with the DevSecOps foundation and OSCAL automation already working.

What Triggers cATO Revocation and What SLAs Keep It Alive?

An AO's dashboard is the whole relationship. When it goes dark, so does trust in the authorization. Programs need to treat dashboard uptime and data freshness as seriously as they'd treat a production outage.

Common revocation triggers include:

  • Missing a Known Exploited Vulnerabilities (KEV) catalog remediation deadline.
  • An unpatched critical CVE sitting past its SLA window.
  • A pipeline gate failure that gets bypassed instead of fixed.
  • A gap in dashboard data, even a short one, since AOs can't authorize what they can't see.

Sustaining cATO means operational SLAs for dashboard availability, patching windows, remediation timing, and penetration testing cadence, all documented and tracked. It also means organizational changes: written runbooks for what happens when a gate fails, CSSP contracts with enforceable response terms, role-based training so system owners understand their evidence obligations, and clear ownership of who's accountable when a control goes stale.

What Lessons Do Early cATO Adopters Offer?

Container scanning alone will not get a program to cATO. Evidence has to span the full chain, source code, build, artifact, and runtime, including provenance, SBOM, and vulnerability exploitability exchange (VEX) data. Programs that tried to shortcut this with container-only scanning consistently hit assessor pushback.

  • Pipeline-attested builds using SLSA-style provenance, paired with OSCAL control mapping, deliver the highest return of any single investment.
  • Platform One and Kessel Run both instrumented their pipelines to produce continuous, queryable evidence rather than periodic manual assessments, and that engineering choice is what made their AO relationships durable.
  • Dashboards succeed when they're built for AO consumption specifically: high-level control family views with drill-downs, not raw tool output.

The evidence chain matters more than any single tool. SAST, SCA, image scanning, SBOM, artifact signing, and runtime telemetry all need to be linked and queryable, or an AO has no reliable basis for trusting the posture.

Primereadysub has built exactly this kind of automation for public-sector clients: pipelines that generate audit-ready evidence instead of evidence assembled after the fact.

What Should Agencies Prioritize First When Pursuing Continuous ATO?

Build the evidence chain and dashboard before expanding scope to additional systems. Agencies that chase breadth before depth end up with three half-instrumented pipelines instead of one AO trusts completely. Engage outcome-owned subcontracting for tightly scoped pipeline and OSCAL work to ensure TAA compliance and smooth procurement processes. It reduces delivery risk far more than staff augmentation does. Pick your first candidate system for short release cycles, not organizational importance.

— Randy

How Primereadysub Helps Agencies Build and Sustain cATO

Primereadysub is the defined-scope alternative to hiring a large staff-augmentation team for cATO buildout. Rather than adding bodies to your existing program, Primereadysub owns a specific work package, whether that's DevSecOps pipeline implementation, OSCAL packaging, or AO-ready dashboard delivery, and delivers it as a finished outcome. That model matters here because cATO buildout is exactly the kind of tightly scoped, technically deep work that suffers when spread across a rotating cast of augmented staff.

How Primereadysub Helps Agencies Build and Sustain cATO — overview diagram

As an SDVOSB and woman-owned modernization partner serving state and federal programs, Primereadysub brings the same automation discipline described throughout this guide, compliance automation, real-time dashboards, and CI/CD pipeline work, into engagements with prime contractors and agencies directly. If your program is weighing where to start, review Primereadysub's modernization work for public-sector clients and start a scoping conversation about your first candidate system.

Sources