Authorization to Operate (ATO) Layer

BloSS@M is designed as a federated, multi-agency environment where software assets, security information, and operational data may be shared across organizational boundaries. Because federal agencies remain subject to FISMA requirements and NIST Risk Management Framework guidance, every participating member must be assessed and authorized before joining the network. Traditional authorization approaches rely heavily on manual reviews, document exchanges, and periodic assessments. In a dynamic environment where members may join, leave, or modify their systems frequently, these processes become difficult to scale and can delay mission operations. The ATO Layer addresses this challenge through automation, continuous monitoring, and machine-readable security artifacts that support timely and risk-informed authorization decisions.

Rather than treating authorization as a periodic event, BloSS@M adopts a Continuous Authorization to Operate (C-ATO) approach.

Continuous ATO focuses on:

• Ongoing assessment of implemented security controls
• Continuous monitoring of system security posture
• Automated collection of security evidence
• Near-real-time risk determination
• Continuous visibility into authorization status

This model enables participating agencies to maintain awareness of security risks as vulnerabilities emerge, configurations change, or threat conditions evolve. Instead of recreating authorization packages from scratch, updated security information can be exchanged and evaluated continuously.

A key enabler of the BloSS@M ATO Layer is the Open Security Controls Assessment Language (OSCAL).

OSCAL is a NIST-developed framework that provides machine-readable formats for documenting, implementing, assessing, and monitoring security controls. It supports standardized representations using XML, JSON, and YAML formats, enabling security information to be exchanged and processed automatically. Within BloSS@M, OSCAL is used to:

• Exchange security documentation in a standardized format
• Represent System Security Plans (SSPs)
• Share assessment plans and assessment results
• Track Plans of Action and Milestones (POA&Ms)
• Support automated control assessments
• Enable continuous monitoring activities
• Provide machine-readable authorization evidence

By replacing manual document reviews with structured data, OSCAL helps reduce assessment effort, improve consistency, and support scalable authorization processes.

Before joining the BloSS@M network, prospective members must demonstrate compliance with the security requirements established by the network governance model and onboarding Memorandum of Understanding (MOU).

Members are expected to:

• Implement required security controls
• Maintain a predefined security posture
• Produce OSCAL-formatted security documentation
• Submit evidence supporting their authorization status
• Participate in ongoing monitoring activities
• Maintain compliance throughout network participation

The onboarding process creates a consistent baseline for trust across all participating organizations while supporting scalable growth of the network.

The BloSS@M ATO Layer relies on automation to evaluate and validate member security posture.

Security information is represented as OSCAL artifacts that can be automatically analyzed and reviewed. These artifacts may include:

• System Security Plans (SSPs)
• Assessment Plans
• Assessment Results
• Plans of Action and Milestones (POA&Ms)
• Authorization evidence and attestations

The use of machine-readable security data enables centralized review, automated validation, ad-hoc auditing, and faster risk analysis while maintaining traceability of security decisions.

BloSS@M leverages blockchain technology to provide a shared, tamper-evident environment for participating organizations. Blockchain technology creates an immutable record of transactions and events that can be independently verified by authorized participants. Within the ATO Layer, this capability supports:

• Traceable authorization activities
• Auditable security evidence
• Trusted attestation records
• Shared visibility into member status
• Improved accountability across participating organizations

This approach helps establish trust among members while preserving each agency's responsibility for managing its own security risks.

The ATO Layer enables BloSS@M to scale beyond traditional authorization approaches by providing: