cATO Continuous Authority

What's included

About this module

An authorization decays the day it is issued unless someone keeps the evidence current. cATO Continuous Authority keeps the plan and the proof in one place: pick a baseline (NIST SP 800-53 Rev 5 Low, Moderate or High, with the privacy baseline if you need it, or a FedRAMP Rev 5 overlay), write how each control is met, mark what is inherited from or shared with a provider, and set parameter values. Control text, baselines and parameters come from NIST's OSCAL files and FedRAMP's baseline workbook, not from anyone typing them in. The editor saves as you type.

Every control shows whether its evidence is current. Evidence is dated by when it was true and expires on the control's refresh period, so a stale screenshot stops counting on its own. Turtini can collect some evidence for you from data it actually holds: who in your organization has a second factor, who has access and when they last signed in, and whether your audit chains verify. External tools such as Tenable, Splunk and AWS Config are not connected.

Weaknesses go on the POA&M with milestones and due dates. The person who fixes an item cannot close it, a deviation is decided by the authorizing official and not by whoever asked, and when the package is ready an ISSM or ISSO submits it, the server hashes it, and a separate authorizing official decides. If the SSP changes in between, the decision is refused until it is resubmitted.

Exports are standard OSCAL JSON for the SSP and POA&M, a POA&M CSV, and a monthly continuous-monitoring report. Turtini does not connect to eMASS or Xacta; bring the files in through their own import. Turtini itself holds no ATO, no FedRAMP authorization and no CMMC certification, and every authorization decision is your authorizing official's.

Who can use it: verified government organizations, and companies and other entities registered in SAM.gov. An entity is admitted when its SAM.gov registration is active, unexpired, not excluded and registered for all awards, and when it shows the registration is its own: an admin whose verified email is a point of contact on the entity's SAM.gov record, or a Turtini reviewer outside the organization who confirms it with the entity. Access ends when the SAM.gov registration expires, or sooner if a periodic re-check of SAM.gov finds it excluded or no longer active. For a contractor working toward CMMC Level 2: choose the NIST SP 800-171 Rev 2 baseline, its 110 requirements with the 320 SP 800-171A assessment objectives, read from NIST's own data files, and keep your SSP, evidence and POA&M against them. The workspace computes no score and no CMMC level, and using it is not an assessment.

What you can do with it

• Write and maintain a system security plan against an official NIST or FedRAMP baseline

• See which controls have current evidence and which have gone stale

• Run MFA, access-roster and audit-integrity checks and keep the results as evidence

• Track POA&M items to verified closure and route deviations to the authorizing official

• Submit an authorization package and record the AO decision against exactly what was submitted

• Export an OSCAL SSP and POA&M, and produce the monthly continuous-monitoring report