ATOs Suck: Navigating the Authority to Operate Process with Chris Sowards
Getting an ATO is a lot like registering a car, if every agency ran its own DMV. Chris Sowards of Watchtower Security Consultants joins Matt to talk risk registers, FedRAMP gaps, and a Jira deployment that wasn’t quite cloud.
The Authority to Operate (ATO) process is meant to show that a federal system is secure enough to run. In practice it’s usually months of checklists, interpretation, and debate with assessors. Host, Matt Triner, talks with Chris Sowards, CEO of Watchtower Security Consultants, about why ATOs are so hard: governance lags behind technology, agencies interpret the same rules differently, and vendors get caught between FedRAMP, impact levels, and their customers’ expectations. They also cover how to get through it anyway.
This Is Fine is the cybersecurity podcast by Hunter Strategy. Where we take the chaos seriously, just not ourselves.
In this episode
- Why an ATO works like registering a car, and why every agency acts like a different state DMV
- “Not applicable” vs. “non-compliant”: how a control gets marked changes who owns the risk
- Why building trust with your assessor matters more than winning arguments
- Where a first-time federal vendor should start, from choosing a 3PAO to documenting everything
- Why impact levels describe cloud services, not software, and what that means for on-prem tools hosted in the cloud
- How the Jira-on-EC2 workaround used transitive trust from a FedRAMP-authorized environment
Chapters
- 00:00 Intro
- 00:34 Matt sets up the episode and introduces Chris
- 01:18 An ATO explained as a yearly car registration
- 03:09 California vs. Michigan: which agencies have the strictest ATOs
- 05:30 SolarWinds and how public scrutiny shapes security posture
- 06:02 FISMA’s ambiguity and why governance can’t keep pace with cloud
- 07:54 Not applicable vs. non-compliant: the MongoDB Community Edition example
- 11:01 Mitigating controls and alternate implementations
- 12:44 Working with assessors: honesty, education, and trust
- 14:36 Advice for a company facing its first ATO
- 17:14 On-prem software in the stack: NIST 800-161, 800-171, and ITAR
- 19:25 Why impact levels apply to cloud offerings, not software
- 20:27 DocuSign vs. Salesforce: the gap in how agencies use FedRAMP
- 21:55 Customer responsibility matrices and transitive trust
- 26:26 The Jira-on-EC2 workaround
- 29:45 How agency sponsorship speeds up FedRAMP authorization
- 30:43 Wrap-up
- 31:00 Outro
Mentioned in this episode
- FISMA (Federal Information Security Modernization Act)
- NIST SP 800-53 (security and privacy controls)
- NIST SP 800-171 (protecting CUI in nonfederal systems)
- NIST SP 800-161 (cybersecurity supply chain risk management)
- FedRAMP (Federal Risk and Authorization Management Program)
- DoD cloud impact levels (IL4 / IL5)
- ITAR (International Traffic in Arms Regulations)
- Third-party assessment organizations (3PAOs)
Guest: Chris Sowards, CEO, Watchtower Security Consultants
Host: Matt Triner, CEO, Hunter Strategy
Each episode brings in practitioners from across federal and commercial work to talk through what it actually takes to keep the lights on in security, technology, and government contracting.
New episodes drop Thursdays. Subscribe wherever you listen.
