As the Department of Defense continues accelerating capability delivery to warfighters, agility, and modern software development are an integral part of the process. Delivering new features rapidly requires an authorization process to keep pace with continuous change for a developing capability. To tackle these challenges, the DoD introduced Continuous Authorization to Operate (cATO)—a new way to ensure security without impeding progress. 

At BreakPoint Labs, we’ve been at the forefront of this paradigm shift, supporting critical DoD cyber missions and accelerating software delivery to users. We’ve had the opportunity to assist organizations in transitioning from a control assessment point-in-time approach to focusing on continuous risk determination and authorization through demonstrated continuous assessing, monitoring, and risk management. Our experience has given us unique insights into the transformational approach that is changing how the Department evaluates and authorizes highly effective development, security, and operations (DevSecOps) practices within a software development environment. As such, we’re introducing a 5-part series titled Unpacking the DoD’s cATO Evaluation Criteria. 

An Introduction to Continuous Authorization to Operate (cATO) 

Continuous Authority to Operate (cATO) is a framework that grants an organization’s systems or networks continuous authorization to assess whether they meet the required security standards. As opposed to traditional “ATO” processes, which require a static cycle of approval, usually every 3 years, cATO offers dynamic, ongoing authorization based on the current security state of systems in runtime. 

The DoD defines cATO as: “The state achieved when an organization that develops, secures, and operates a system has demonstrated enough maturity in maintaining a resilient cybersecurity posture that traditional risk assessments and authorizations become redundant.”2

This approach aligns with the DoD’s Software Modernization Strategy, pushing for better DevSecOps practices and faster, more secure software deployment. The March 2025 State of DevSecOps report published by the DoD CIO describes DevSecOps as a critical enabler of the shift to cATO, noting that over 50 DoD software factories are now delivering code using DevSecOps practices.

From ATO to cATO 

The traditional ATO process was sufficient when systems were less complex and security challenges were more predictable. However, with the rise of cloud technologies, continuous deployment models, and ever-evolving cybersecurity threats, organizations found that static authorization led to blind spots in security compliance. 

This is where cATO comes into play. Instead of evaluating systems at predefined intervals, cATO ensures systems remain compliant through ongoing assessments, allowing organizations to maintain security postures dynamically without significant downtime.

The Three Pillars of cATO  

  1. Continuous Monitoring (CONMON):
    • Continuous Monitoring is at the heart of cATO. It’s all about maintaining real-time visibility into key cybersecurity activities. No more “set it and forget it.” This goes beyond periodic assessments, requiring robust, near real-time monitoring of Risk Management Framework (RMF) controls. Organizations must demonstrate the capability to aggregate and visualize security data from multiple sources, giving authorized officials an up-to-the-minute view of their security posture.2,3
  2. Active Cyber Defense (ACD):
    • With increasingly sophisticated cyber threats, a reactive stance is no longer sufficient. cATO evaluation criteria demand the ability to conduct active cyber defense, responding to threats in real time. This includes integrating with Cybersecurity Service Providers (CSSPs), implementing automated threat detection and response mechanisms, and conducting regular penetration testing and vulnerability assessments.2,3
  3. Secure Software Supply Chain (SSSC):
    • A solid DevSecOps foundation is crucial for cATO. Using an approved reference design ensures that security is integrated throughout the entire software development lifecycle—from design all the way to deployment. This means automating security checks and adopting Infrastructure as Code (IaC) for consistent and reliable deployments. SSSC also covers securing the software supply chain against threats, as described in the March 2025 State of DevSecOps report. 1,3

 

 

The DoD’s shift to cATO also incorporates Zero Trust principles. The March 2025 State of DevSecOps report explicitly frames cATO as incorporating real-time assessment, Zero Trust principles, and DevSecOps to secure the supply chain against emerging threats. Organizations building toward cATO should treat Zero Trust architecture as a foundational element, not a parallel initiative.

Key Components of cATO Evaluation Criteria 

As organizations prepare for cATO evaluation, they should focus on: 

DevSecOps Platform (DSOP): The set of tools and automation that supports software development, including secure pipelines and control gates.  

Processes: Workflows and practices that ensure continuous risk management and seamless integration of security.

 

 

People: The skills, training, and collaboration between teams responsible for development, security, and operations. Building a culture of security is just as important as the technology.

What Does This Mean for DoD Components? 

For Military Services and DoD Agencies and Field Activities, cATO isn’t just a buzzword—it offers advantages in the form of: 

  1. Faster Software Delivery: cATO enables organizations to deploy new updates or patches more frequently without waiting for complete compliance cycles, reducing the vulnerability risk window.  
  2. Enhanced Security: With continuous monitoring and active defense, systems become more resilient, making it easier to detect and respond to threats.2
  3. Reduced Administrative Burden: The days of time-consuming manual reviews are behind us. Automation lets teams focus on what matters, reducing the need for endless paperwork.  
  4. Increased Agility: cATO enables agencies to adapt quickly to changing mission needs and new threats. 
  5. Better Alignment with Modern Development: cATO supports the shift to DevSecOps and agile methodologies, fostering innovation while maintaining security.
  6. Align with Zero Trust Principles: Zero Trust architecture is a foundational component of cATO. The DoD’s shift to continuous authorization incorporates real-time assessment and Zero Trust principles to secure the supply chain against emerging threats. Organizations should treat Zero Trust implementation as a prerequisite, not a parallel initiative.

Implementing cATO within DoD Components 

To implement cATO, organizations need to adopt a blend of automation tools, monitoring platforms, and updated security practices.  

Key steps include: 

  1. Automate Security Assessments: Use tools that provide automated vulnerability scanning, compliance checks, and reporting to continuously monitor the security status. 
  2. Develop a Risk Management Framework: Establish clear criteria for evaluating risks, prioritizing those that pose the greatest threat to the organization. 
  3. Leverage Cloud Services: Many cloud service providers offer built-in tools for continuous monitoring and reporting. Utilize these to reduce the burden of managing complex environments.  
  4. Training and Culture: Ensure that all team members understand the principles of cATO and are equipped to use the necessary tools effectively.  
  5. Integration with DevOps: For organizations practicing DevOps, cATO aligns well with continuous integration/continuous deployment (CI/CD) pipelines, allowing for secure and rapid releases. 

Looking Ahead 

As we dive deeper into cATO Evaluation Criteria throughout this series, we’ll explore each of these pillars in detail and offer practical insights and strategies for implementation. We’ll draw on our extensive experience supporting critical DoD initiatives to provide a roadmap for organizations looking to embrace this new standard in cybersecurity and software deployment. 

The path to cATO is less about process change and more about the shift in how software development and security are approached. cATO offers DoD Components a modernized authorization process for dynamic, resilient software development environments to deliver secure, scalable, and reliable software at the speed modern warfare demands. 

Frequently Asked Questions

What is cATO and how does it differ from a traditional ATO?

A traditional Authorization to Operate is a point-in-time approval, typically renewed every three years, based on a compliance review conducted at a specific moment. A Continuous Authorization to Operate replaces that static cycle with ongoing authorization based on the real-time security state of the system. The DoD defines cATO as the state achieved when an organization has demonstrated enough maturity in maintaining a resilient cybersecurity posture that traditional risk assessments become redundant. Rather than proving compliance at intervals, organizations must demonstrate continuous monitoring, active cyber defense, and a secure software supply chain as ongoing capabilities.

What are the three pillars of DoD cATO?

The DoD cATO framework rests on three pillars. The first is Continuous Monitoring (ConMon), which requires near real-time visibility into Risk Management Framework controls, with aggregated security data available to authorizing officials continuously rather than at scheduled intervals. The second is Active Cyber Defense (ACD), which requires real-time threat response, integration with Cybersecurity Service Providers, and a regular cadence of penetration testing and vulnerability assessments. The third is Secure Software Supply Chain (SSSC), which requires security to be integrated throughout the software development lifecycle using approved DevSecOps platforms, automated control gates, and Infrastructure as Code. Each pillar is covered in detail in this series.

How does DevSecOps enable cATO?

The March 2025 State of DevSecOps report published by the DoD CIO describes DevSecOps as a critical enabler of the shift from point-in-time risk assessment to continuous authorization to operate. An organization practicing DevSecOps is building the pipeline, automation, monitoring, and culture that cATO requires. The report notes that cATO incorporates real-time assessment, Zero Trust principles, and DevSecOps to secure the supply chain against emerging threats. DevSecOps is the methodology that makes continuous assessment operationally possible. cATO is the authorization outcome that recognizes that maturity.

What role does Zero Trust play in cATO?

The DoD’s March 2025 State of DevSecOps report explicitly frames cATO as incorporating Zero Trust principles alongside real-time assessment and DevSecOps. Zero Trust requires continuous verification of every user, device, and connection rather than assuming trust based on network location or prior authorization. This aligns directly with cATO’s requirement for continuous rather than periodic security assessment. Organizations building toward cATO should treat Zero Trust architecture as a foundational requirement, not a parallel initiative.

What is the difference between cATO and DevSecOps?

DevSecOps is the practice of integrating security into software development and operations continuously rather than treating it as a phase at the end of the development cycle. cATO is the DoD authorization framework that recognizes and rewards that maturity. An organization practicing DevSecOps is building the foundational capability that cATO requires. DevSecOps is the methodology. cATO is the formal recognition that an organization’s development, security, and operations practices are mature enough that traditional point-in-time risk assessments become redundant.

What is the DoD Software Engineering Guide and how does it relate to cATO?

The Software Engineering for Continuous Delivery of Warfighting Capability guide is published by the Office of the Under Secretary of Defense for Research and Engineering. It provides guidance for DoD Program Management Offices, systems engineers, and acquisition officials on modern software development practices. The guide has gone through three revisions: initial release in April 2023, a December 2024 revision that clarified Agile and DevSecOps terminology and metrics, and a July 2025 revision that substantially updated guidance on AI and machine learning. For cATO programs, the guide defines the engineering and DevSecOps practices that underpin the Secure Software Supply Chain pillar of cATO evaluation.

How does penetration testing fit into a cATO program?

Penetration testing is an explicit requirement under the Active Cyber Defense pillar of cATO. It’s not a one-time compliance gate but a recurring component of the continuous assessment posture. Organizations pursuing cATO need to demonstrate a regular cadence of adversarial testing as evidence that security is actively managed. The findings from penetration tests feed directly into the continuous risk determination process and give the Authorizing Official current data on exploitable risk rather than a compliance status based on a prior snapshot.

What is the Authorizing Official’s role in cATO?

The Authorizing Official accepts risk on behalf of the organization and grants the authorization to operate. In a traditional ATO, this decision is based on a point-in-time assessment package reviewed periodically. In cATO, the Authorizing Official needs continuous, near real-time visibility into the system’s security posture so risk decisions can be made as the environment changes rather than on a fixed review schedule. This shifts the AO from periodically reviewing static documentation to maintaining ongoing awareness through a live security dashboard.

What is Infrastructure as Code and why does it matter for cATO?

Infrastructure as Code means that system and environment configurations are defined and managed through code rather than manual processes. For cATO, IaC matters because it creates a consistent, auditable, and repeatable deployment process where security controls are enforced programmatically at every deployment. It reduces configuration drift, the gradual deviation of a live system from its authorized security baseline, which is one of the core failure modes that point-in-time authorization processes cannot detect between review cycles.

What is a DoD software factory and what does it have to do with cATO?

The DoD defines a software factory as a collection of people, tools, and processes that enables teams to continuously deliver value by deploying software to meet the needs of a specific community of end users. The March 2025 State of DevSecOps report notes there are over 50 DoD software factories now using DevSecOps to deliver code into production. Software factories represent the organizational implementation of the DevSecOps practices that cATO evaluation is built around. A program operating with a software factory has the foundational infrastructure that cATO requires.

Is cATO mandatory for DoD programs?

cATO is not universally mandatory, but it is the preferred authorization approach for programs using continuous deployment models under the DoD Software Modernization Strategy. Programs delivering software updates frequently and operating in cloud or DevSecOps environments are the primary intended audience. Programs still operating on traditional waterfall development cycles may find that a traditional ATO remains more practical, but the direction of DoD policy is clearly toward continuous authorization for modern software development environments.

How long does it take to achieve cATO?

There is no fixed timeline because cATO is a state of demonstrated maturity rather than a certification with a defined endpoint. Organizations starting from a traditional ATO posture should expect the transition to take significant time, as it requires building or maturing pipelines, monitoring tooling, DevSecOps practices, and organizational culture across development, security, and operations teams. The March 2025 State of DevSecOps report identifies bureaucratic inertia aligned to traditional approaches as one of the primary barriers, noting that existing processes across cyber, test and evaluation, acquisition, and requirements all need to be realigned toward rapid incremental delivery.

Where can I find the official DoD cATO and DevSecOps guidance?

The primary reference documents are the DoD CIO’s Continuous Authorization to Operate memo, the DevSecOps Continuous Authorization to Operate Evaluation Criteria, the March 2025 State of DevSecOps report published by the DoD CIO at dodcio.defense.gov, and the Software Engineering for Continuous Delivery of Warfighting Capability guide published by OUSD R&E and last updated July 2025 at cto.mil. For programs operating within a specific military service, check for service-specific implementation guidance in addition to these DoD-level documents.

1. Department of Defense Software Modernization Strategy – DoD CIO

2. Continuous Authorization To Operate (cATO) Memo – Department of Defense

3. DevSecOps Continuous Authorization to Operate Evaluation Criteria – DoD CIO

4. DevSecOps Continuous Authorization to Operate Evaluation Criteria – DoD CIO

5. Software Engineering for Continuous Delivery of Warfighting Capability, July 2025 – Office of the Under Secretary of Defense for Research and Engineering