Today’s episode takes you on a (somewhat procedural) ride through the world of government security authorizations. Matt Triner and Chris Sowards, a GRC (Governance, Risk, and Compliance) expert at Hunter Strategy, break down the Authority to Operate (ATO) process using a relatable analogy: buying a car. Just like how buying a car is a decision that involves cost, efficiency and risk, the government needs to use a multitude of factors to review the security risks before allowing a system to operate.
We'll explore the differences in ATO processes between agencies, how they handle risk tolerance, and the challenges companies face, like dealing with non-essential controls and navigating compliance culture. Matt and Chris talk through a range of topics offering advice for new companies and discuss the struggles of FedRAMP accreditation. They’ll even touch on the specific challenges faced by software vendors in obtaining ATOs.
Don't miss this episode if you're interested in government risk and compliance, selling software to the government, or wonder why it takes so long for the government to get new systems online!
Chapters:
00:00 Introduction to ATO Process
01:29 ATO Process Analogy: Buying a Car
03:02 Different ATO Processes for Different Agencies
04:55 Different Risk Tolerance for Different Agencies
06:10 Challenges in the ATO Process
08:02 Dealing with Non-Applicable Controls
09:30 Navigating ATO Process for New Companies
11:09 Bizarre Situations in ATO Remediation
12:31 Navigating Compliance and Mitigating Controls
13:23 Teaching Assessors about System Security
14:45 Advice for Companies Selling to the Government
17:23 ATO for On-Prem Software in the Cloud
19:19 Challenges with Cloud-Based Systems
21:33 Struggles with FedRAMP Accreditation
25:02 ATO for Software Providers
27:09 ATO Challenges for Atlassian Suite
28:58 Using AWS Infrastructure for On-Premise Jira
29:57 Challenges in Assessing SAS Applications
30:36 The Role of Third-Party Assessors
31:24 Conclusion and Future Topics