Katie Arrington, acting chief information officer at the Department of Defense and a Wash100 Award winner, is keen on automating and applying artificial intelligence to accelerate the process of granting an authority to operate, or ATO, to software for integration into Pentagon networks.
The official said at the Billington Cybersecurity Summit, as reported by Breaking Defense, that taxpayers pay for ATO, which is why she wants to use advanced tools to accelerate the process and cut associated costs.
Government Looks to Automation, AI to Streamline ATO
Other government leaders at the event discussed how their respective organizations are implementing technologies to enhance the ATO process.
Dave Raley, who leads a team called Operation Stormbreaker at Marine Corps Community Services, shared that automation is already improving the process of granting an ATO. He shared that the Marine Corps’ Authorizing Officer approves an ATO package within 24 hours, whereas, traditionally, the process would take much longer.
Doug Cossa, the intelligence community CIO, revealed that the IC has an “espresso ATO” or “the minimum set of controls” software needs to have in place to automatically get an authorization.
“Right now, while we define those, it’s a manual process,” he added. “We’re looking to automate that evaluation … over the next year.”
More Than Just Technology
Dave McKeown, the Pentagon’s chief information security officer and a two-time Wash100 awardee, explained that vendors who want to speed up the process and get their products approved for use at the DOD need to submit a software bill of materials and provide proof of Secure Software Development Framework compliance. The documentation would enable AI to check the cybersecurity soundness of a software and grant authority, he said.
Moreover, McKeown divulged that defense leaders plan to overhaul the Risk Management Framework, or RMF. While he said the DOD is not getting rid of RMF, the framework will be modified to shift focus from “compliance and checklists and humans to cybersecurity and cyber survivability and automation.”
