The Authority to Operate (ATO) is the formal security sign-off required before BenefitConnect
can go live in production. It has no real equivalent in commercial healthcare PM work — a HIPAA risk assessment
is closer, but an ATO is a harder, non-negotiable gate: without it, the system simply does not launch, regardless
of schedule pressure.
Owned by T. Abernathy (ISSO), reviewed by M. Whitcombe (COR), and formally granted by the
agency's Authorizing Official — not by anyone on the contractor team or FOPBA program staff.
System Boundary & Description
| System Name | BenefitConnect Portal (citizen-facing benefits application system) |
| Boundary Includes | Public-facing web application, application API layer, benefits-eligibility integration, applicant document storage, and the production cloud environment hosting all of the above |
| Boundary Excludes | Case-worker-facing backend adjudication system (a separately authorized system this portal integrates with via API, not replaces — see PWS Scope) |
| Data Types Processed | Applicant PII (name, SSN, address, income), benefits application status, uploaded supporting documents |
| Interconnections | Benefits-Eligibility Verification API (case-worker system), legacy platform (one-way, read-only, migration period only) |
System Security Plan (SSP) — Summary
| System Categorization | Moderate (FIPS 199) — handles applicant PII but not classified data |
| Security Control Baseline | NIST SP 800-53 Moderate baseline |
| Assessment Method | Independent Security Control Assessment (SCA) by third-party assessor |
| Target ATO Date | Dec 14, 2026 (Milestone Gate 1) |
POA&M — Plan of Action & Milestones (open findings)
| Finding | Severity | Remediation Owner | Target Close | Status |
|---|
| Session timeout exceeds moderate-baseline threshold | High | K. Lindqvist | Nov 14, 2026 | Open |
| Audit logging gap on legacy data import path | Moderate | K. Lindqvist | Nov 14, 2026 | Open |
| MFA not yet enforced for admin console | High | T. Abernathy | Oct 15, 2026 | Closed |
Why This Gate Matters for the Schedule
Every open High-severity POA&M finding is a direct risk to
Milestone Gate 1 (see the IMS and RAIDD Log, R-01). A federal PM's job here isn't to do the security work
itself — it's to actively track POA&M burn-down against the schedule and escalate early if remediation
is slipping, since an ATO delay is a hard go-live blocker, not a negotiable one.
Authorization Decision
| Decision Type | Authorization to Operate (full ATO) — pending open High-severity POA&M closure ahead of Milestone Gate 1 |
| Authorizing Official | FOPBA Agency Authorizing Official (AO) — outside the Task Order team, per RMF separation-of-duties requirement |
| Basis for Decision | SSP, Security Assessment Report (SAR) from the independent SCA, and this POA&M, submitted together as CDRL A007 |
| Authorization Term | 3 years from grant date, subject to continuous monitoring (see Stabilization Support, IMS 7.2) and re-authorization if the system boundary materially changes |