Formal federal authorisation that an information system may operate at an accepted level of risk.
An Authority to Operate is the formal management decision by a federal authorising official to authorise operation of an information system and explicitly accept the risk to organisational operations, assets, and individuals — based on the implementation of an agreed-upon set of security controls (NIST RMF).
Run a free ComplianceIQ audit against FedRAMP and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.