"FedRAMP ATO" is one of the most searched and most misunderstood phrases in government cloud. People use it to mean several different things: an agency's decision to use a system, a FedRAMP designation on the Marketplace, or the old Joint Authorization Board's provisional authorization. In 2026, FedRAMP itself changed its terminology to reduce exactly this confusion.
This guide explains what an ATO is, how it relates to FedRAMP, what changed with FedRAMP 20x and the Consolidated Rules for 2026, and what the ATO process looks like for a cloud provider today.
What does ATO mean?
ATO stands for Authorization to Operate (sometimes written "authority to operate"). It is a formal decision by a federal agency's Authorizing Official (AO) to accept the risk of operating an information system, based on the system's security posture. The concept comes from OMB Circular A-130 and the NIST Risk Management Framework (NIST SP 800-37), and applies to federal information systems generally, not only cloud.
Key point: an ATO is issued by an agency, for that agency's use. Each agency that uses a system is responsible for its own authorization decision.
FedRAMP ATO vs FedRAMP authorization vs FedRAMP certification
Agency ATO
An agency authorizes its use of a system under A-130. When that system is a cloud service, the agency typically relies on FedRAMP to avoid assessing the provider from scratch.
FedRAMP authorization (now "FedRAMP Certification")
FedRAMP standardizes the security assessment of cloud services so agencies can reuse it. The FedRAMP Authorization Act (enacted in December 2022 as part of the FY2023 NDAA) codified the program.
Under the Consolidated Rules for 2026, FedRAMP now uses the term "FedRAMP Certification" instead of "FedRAMP authorization." FedRAMP's stated reason is to stop conflating FedRAMP's status with an agency's authorization to operate, which has its own meaning under A-130. FedRAMP explicitly notes that a FedRAMP authorization was never a blanket risk acceptance across the whole federal government.
What happened to the JAB P-ATO?
For years, the Joint Authorization Board (JAB), made up of DoD, DHS, and GSA, issued Provisional ATOs (P-ATOs). Following OMB memo M-24-15 (July 2024), the JAB was replaced by the FedRAMP Board, which provides governance and oversight but does not approve individual authorization packages. FedRAMP moved to a single "FedRAMP Authorized" designation; providers that previously held a JAB P-ATO keep that history noted in their Marketplace listing. New JAB P-ATOs are no longer issued.
The FedRAMP ATO process in 2026
FedRAMP now describes two certification types (20x and Rev5) and two certification paths (Program and Agency).
FedRAMP 20x (Program Certification)
- FedRAMP 20x moved from pilot to a widely available certification path under the Consolidated Rules for 2026.
- 20x uses the Program Certification path: certification is provided directly by FedRAMP and does not require an agency sponsor.
- 20x Classes A, B, and C are available; Class D is planned for 2027.
- 20x emphasizes clearer, measurable, reusable evidence, with automation over hand-written documents.
FedRAMP Rev5 (Agency Certification)
- Rev5 is based on NIST SP 800-53 Revision 5 baselines and generally follows the Agency Certification path: an agency authorizes the service (its ATO) and then sponsors it for FedRAMP Certification.
- Assessments are performed by an independent Third Party Assessment Organization (3PAO).
- Two limited Rev5 Program Certification pipelines (Ready Conversion and Lost Sponsor) opened in August 2026 for eligible Class B and C providers.
- FedRAMP will stop accepting new Rev5 certification applications on June 11, 2027. Existing Rev5 certifications remain active until at least December 31, 2028, and providers are expected to plan a transition to 20x.
Classes replace impact levels
FedRAMP has moved from "Low / Moderate / High" impact levels to Certification Classes A, B, C, and D. Agencies still categorize their own federal information systems under FIPS 199/200. Do not assume a one-to-one mapping between old levels and new classes; check the class definitions on fedramp.gov.
Typical stages
FedRAMP describes the lifecycle as Preparation → Initial Implementation → Ongoing Certification:
- Preparation: define the cloud service offering, its authorization boundary, and the certification type and class you are targeting; build the security program and evidence automation.
- Initial implementation: implement and validate requirements, complete the assessment, and submit the certification package (the Consolidated Rules move packages away from Word/Excel templates toward simplified JSON or, optionally, OSCAL).
- Agency ATO: agencies that want to use the service issue their own ATO, relying on the FedRAMP certification.
- Ongoing Certification: FedRAMP's new term for what was called continuous monitoring, which now covers more than monthly scans, including vulnerability detection and response. POA&Ms are replaced with a list of accepted weaknesses.
What about "FedRAMP Ready"?
FedRAMP Ready indicated a 3PAO readiness assessment had been accepted. Under the 2026 rules, FedRAMP Ready became legacy on July 28, 2026, and no new Ready submissions are accepted. Some recently Ready providers may qualify for the Ready Conversion pipeline.
How architecture shapes the ATO
Whatever path you take, the ATO conversation is ultimately about whether the system's design holds up. Areas that most often decide outcomes:
- Authorization boundary: everything that stores, processes, or transmits federal data, plus connections to external services, must be identified. Undocumented data flows are a common source of findings.
- Data movement: how data moves between the agency, the provider, subcontractors, and increasingly AI systems. Each uncontrolled path widens the boundary.
- Identity and least privilege: explicit, attributable access for people and automated services.
- Encryption: FIPS 140 validated cryptography where it protects sensitive data. The 2026 rules ask providers to document their FIPS 140 use so agencies can judge how it fits their intended use.
- Evidence: logs and records generated automatically by the system, which is exactly the direction 20x pushes.
Stellarbridge's own take on this, FedRAMP authorization and cloud architecture, argues that compliance artifacts should reflect enforced design rather than make up for missing design.
How Stellarbridge fits
Stellarbridge is not a FedRAMP certified service, and it does not perform FedRAMP assessments. Where it can help teams on the path to an ATO is the data-movement part of the architecture: governed storage and transfer of sensitive files with a policy engine that allows, denies, or requires human approval for each action, distinct identities for people and AI agents, encryption in transit and at rest, and audit trails and chain-of-custody reports exportable to a SIEM.
For programs where data must stay inside a boundary you control, Stellarbridge offers self-hosted deployment with the same governance model as the managed product, so the data flows, policy decisions, and audit records sit inside your own authorization boundary. Talk to the team if you are designing those flows.
FAQ
What is a FedRAMP ATO?
In common usage it means a cloud service is approved for federal use. Precisely, an ATO is an agency's authorization decision under OMB A-130; FedRAMP provides a standardized, reusable assessment, now called FedRAMP Certification, that agencies rely on when issuing their ATOs.
What is the FedRAMP ATO process?
Prepare your offering and boundary, choose 20x (Program Certification, no sponsor needed) or Rev5 (generally Agency Certification with a sponsor), complete assessment and package submission, receive agency ATOs, then maintain Ongoing Certification.
What does FedRAMP ATO meaning "authority to operate" vs "authorization to operate" refer to?
They are used interchangeably for the same concept: a formal decision by an authorizing official to accept the risk of operating a system.
Does the JAB still issue P-ATOs?
No. The JAB was replaced in 2024 by the FedRAMP Board, which handles governance rather than individual package approvals. Prior JAB authorizations are noted historically on the Marketplace.
How long does a FedRAMP ATO take?
Timelines vary widely with system complexity, readiness, path, and agency involvement. FedRAMP 20x aims to make the process faster and more automated; treat any fixed timeline claim with caution.