Maintaining an ATO after authorization
Sustaining an ATO fails for a structural reason — authorization is resourced as a project and maintenance is not. The fix is to make the impact of a change derivable rather than something a person has to happen to notice.
Programs are good at getting authorized. There is a deadline, a named team, visible executive attention and a clear finish line.
Then the finish line passes, the team disperses, and the authorization becomes somebody’s collateral duty. This is not a discipline failure. It is what happens when a continuous obligation is resourced as a one-time project.
What actually goes stale
Not the ATO letter. The record underneath it.
- A component is replaced during a routine refresh. Nobody tells the ISSO.
- A new STIG is released for a technology in the inventory.
- A scan finding is remediated in Jira and the POA&M is never updated.
- An implementation statement describes a configuration that changed two sprints ago.
- Evidence for a control depicts a boundary that no longer exists.
Each is small. None triggers anything. Collectively they are why the package assembled for the next review bears a decreasing resemblance to the system.
Why “just review it annually” does not work
Because an annual review does not know where to look.
Without a record of what changed, a review is either superficial — confirming the document is internally consistent, which it will be — or a full re-derivation of the whole baseline, which nobody has the hours for. So in practice it is superficial, and drift accumulates until something forces a real look.
Make the change the trigger
The alternative is to let the system’s own changes generate the work.
Version the architecture. Publish each state as an immutable, content-hashed version. Now “what changed?” is a diff rather than a conversation.
Derive the affected control scope. Given a diff, the set of controls in scope for reassessment is computable. That turns an unbounded review into a bounded task.
Measure inventory drift. Compare snapshots rather than eyeballing them. The category that reliably escapes manual comparison is the component that kept its name and changed underneath it.
Rank STIG applicability against real inventory. New technology means newly applicable STIGs, and that should arrive as work rather than as a discovery.
Track evidence continuity. Ageing evidence should surface before a review.
Schedule reviews as a chain you can verify. A plan produces occurrences; an occurrence becomes a campaign; a campaign records which controls and CCIs it actually touched. That is the difference between saying “we review annually” and being able to show it happened, at the granularity it happened at.
The reframe worth making internally
Sustainment tooling is usually pitched as a way to get authorized faster. For a program that is already authorized, that pitch is irrelevant and the tool looks like a cost with no matching benefit.
The honest framing is the opposite. If you are already authorized you have the most valuable thing — a complete authorization record — and no mechanism for keeping it true. Importing that state and keeping it current is worth more than generating it was.