What is an Interim Authorization to Operate (IATO) and when is it used?

• A. A formal, final decision to operate after full authorization.
• B. A temporary denial of authorization due to missing approvals.
• C. A provisional ATO granted when not fully compliant or assessment is in progress.
• D. A full authorization requires no conditions.

Answer: (C)

An Interim Authorization to Operate is a provisional Authority to Operate that lets a system run while its full security accreditation is not yet complete or when not all security requirements have been fully met. It is granted by the designated authorizing official for a defined, limited period and comes with specific conditions and monitoring controls. The purpose is to enable essential, mission-critical operations without delaying them while the remaining security assessments, testing, or certification steps are finished. Because it’s temporary, the system must be re-assessed and either obtain a full ATO by satisfying all conditions or be shut down once the interim period ends.