Which of the following is a temporary approval to operate based on an assessment of the implementation status of the assigned IA Controls?

The correct answer is A. IATO. IATO (Interim Authorization to Operate) is correct because it is specifically defined as a temporary approval granted when a system cannot yet meet all requirements for a full ATO - it is explicitly tied to an assessment of how far along the assigned IA (Information Assurance) Co

Risk Management

Question

Options

AIATO
BDATO
CATO
DIATT

How the community answered

(18 responses)

A
89% (16)
B
6% (1)
C
6% (1)

Explanation

IATO (Interim Authorization to Operate) is correct because it is specifically defined as a temporary approval granted when a system cannot yet meet all requirements for a full ATO - it is explicitly tied to an assessment of how far along the assigned IA (Information Assurance) Controls implementation has progressed.

ATO (Authorization to Operate) is a full, not temporary, authorization issued when all security requirements have been satisfied. IATT (Interim Authorization to Test) is also temporary, but it only permits testing of a system - not operational use. DATO (Denial of Authorization to Operate) is the opposite of approval; it formally prohibits a system from operating.

Memory tip: Think of the "I" prefix as "Interim" (temporary). Between IATO and IATT, remember IATO = Operate and IATT = Test - alphabetically, O comes before T, just as you'd operate a system before fully testing its replacement.

Topics

#Authorization To Operate (ATO)#Interim Authorization To Operate (IATO)#Assessment and Authorization (A&A)#Risk Management Framework (RMF)

Community Discussion

No community discussion yet for this question.

Full CISSP-ISSEP Practice