Authorization to Operate

ATO is a formal declaration by a designated authorizing official that authorizes operation of an information system and explicitly accepts the risk to organizational operations, organizational assets, individuals, or other organizations based on the implementation of an agreed-upon set of security controls.