What is the Ongoing Authorization (OA) Program?

The CMS Ongoing Authorization (OA) Program represents a fundamental evolution in how CMS manages cybersecurity risk across the enterprise by shifting from periodic, point-in-time Authorization to Operate (ATO) decisions to a continuous, risk-informed authorization model.

This shift enables CMS to:

• See risk earlier through real-time security intelligence,
• Respond faster to emerging threats and vulnerabilities,
• Make more informed decisions based on continuous data rather than three-year snapshots.

What is the purpose of the OA Program?

The traditional authorization model relies on a time-bound ATO — a point-in-time assessment conducted every three years. This model creates dangerous security blind spots and is increasingly inadequate in a dynamic threat environment where vulnerabilities emerge daily and system configurations change continuously.

The CMS OA Program addresses this gap by transitioning from periodic, compliance-driven reviews to a continuous, risk-informed authorization model.

Strategic Value Pillars

Continuous Authorization Engine

The OA Program operates through a continuous authorization engine — the intersection where real-time technical data meets structured governance to create a continuous cycle of security. In the OA model, security findings are treated as risk indicators for early intervention, rather than punitive measures.

Five Pillars of the Engine

1. Automated Security Data — Ingestion of real-time metrics, moving away from static, point-in-time snapshots.
2. Continuous Monitoring — 24/7 tracking of system health, providing a constant pulse on security posture.
3. Remediation Tracking — Proactive management and tracking of vulnerabilities as they arise.
4. Governance Reviews — Technical data evaluated against established thresholds.
5. Executive Risk Oversight — Objective, real-time data feeds up to leadership for informed decision-making.

The SDL Risk Engine

The Security Data Lake (SDL) serves as the analytical brain of the OA Program — the Risk Engine. It does not simply collect data; it contextualizes, correlates, and prioritizes findings across all integrated feeds to produce actionable risk intelligence. The Risk Engine transforms thousands of daily data points into clear, decision-ready outputs.

OA Process

Before a CMS information system can transition to OA, it must complete the formal onboarding process. During this process, systems must first meet the established eligibility criteria to be considered OA candidate systems. ISPG then selects and prioritizes systems from the pool of eligible OA candidates for onboarding. Once the onboarding process is successfully completed, the system is formally listed as an OA Member.

OA Candidate

To be considered as an OA Candidate, systems must meet the following eligibility criteria:

ADMINISTRATIVE READINESS

1. Active ATO with Minimum 6-Month Remaining Validity
2. Current CSRAP or SCA Completion (Within 12 Months)
3. Penetration Test Completion Within 12 Months (High & HVA Systems)
4. Compliance Artifacts in Good Standing (CP, ISRA, PIA)
5. OA Program Dashboard Metrics Compliance at Time of Selection
6. No Active or Planned Decommissioning

TECHNICAL READINESS

1. Full CMS AWS Cloud Hosting (no Hybrid or External SaaS)
2. AWS Security Hub (SecHub) Enablement for Cloud Security Posture Management (CSPM)
3. Validated CDM Core Data Feed Integration (HWAM, VUL, SWAM, CONFIG)
4. Verified Reporting Integration and Dashboard Visibility

OA Onboarding

System selection for OA onboarding is governed by objective, data-driven criteria. This rigorous eligibility framework ensures that every system entering the OA model is instrumented and ready for continuous monitoring from day one.

As systems become eligible DSPC will produce a list of systems, along with OA dashboards and executive summaries, to be sent to the CISO for approval for the next wave of onboarding.

Once a system is selected, the onboarding follows a structured sequence:

OA Member

Once a system becomes an OA member, the system must:

• Adhere to the established OA governance structure and program requirements as documented in the CMS Ongoing Authorization program guidance
• Continue required monitoring and reporting activities — to include maintaining the published OA metrics
• Address identified risks in a timely manner
• Maintain all CMS IS2P2 required processes and documentation
• Review all system changes to ensure continued OA eligibility
• Participate in OA enhancement efforts as requested by ISPG

Metrics and Thresholds

CMS uses the OA Program Dashboard as the primary tool for system stakeholders and the OA Team to monitor system compliance with OA metrics on a reoccurring basis. The dashboard provides real-time visibility into each system's risk posture across multiple dimensions.

The metrics below represent the baseline set currently displayed on the OA dashboard. As the risk engine matures — informed by additional data sources and evolving industry threats — these metrics will be refined and expanded accordingly.

Current OA Dashboards

OA Program Dashboard

A live, system-by-system view of risk health across OA — Asset Risk Tolerance, Vulnerability Risk, and Configuration Settings, refreshed daily, with quick visibility-gap flags and filters by system acronym, OA status, and public-facing status.

Continuous Monitoring Visibility Matrix

A system-by-system checklist of security tool coverage across OA — Configuration, Hardware, Vulnerability, EDR, and emerging tools like Wiz and Invicti — with red dots flagging capabilities still in progress.

Cyber Risk Management (CRM) Dashboards Portal

Your one-stop launchpad for every CMS risk dashboard — KEVs, vulnerabilities, SecHub findings, SWAM, configuration compliance, MFA analysis, and more, filterable by component, system, or TLC phase.

Governance

The OA Program employs a four-tier risk escalation model that provides a structured, risk-informed approach to managing system compliance. Escalations are risk-informed, trend-based, and subject to leadership discretion at any tier. CMS retains authority for immediate escalation at any tier for significant security incidents, material control failures, or unacceptable cyber risk levels.

• The four-tier model is graduated and proportionate — systems are supported before they are penalized
• The CRA (Cyber Risk Advisor) and OA Oversight Team play a central coordination role across all tiers
• Final determinations always rest with CMS Leadership and Authorizing Officials
• The GRC tool is the system of record for all OA status changes, OA Memo uploads, and compliance tracking

Tier 1 — Green: Continuous Monitoring and Risk Observation

Baseline tier for all OA-enrolled systems operating within acceptable risk thresholds. Focus is on maintaining awareness and supporting proactive remediation.

Status: Good Standing / Acceptable Risk

Key Characteristics:

• OA metrics are used as risk indicators, not punitive measures
• Automated findings do not indicate loss of authorization suitability
• Informal stakeholder engagement on remediation activities
• Standard CDM monitoring and OA Dashboard review cadence

Tier 2 — Yellow: Enhanced Oversight and Targeted Remediation

The presence of adverse risk trends, recurring deficiencies, delayed remediation, or elevated cyber risk indicators warrants targeted remediation.

Triggers:

• Adverse risk trends
• Recurring deficiencies
• Delayed remediation
• Elevated cyber risk indicators

Actions Taken:

• Enhanced monitoring frequency
• Formal remediation plans (SIP/CAP — Security Improvement Plan / Corrective Action Plan)
• Periodic status reviews with the OA Team
• Targeted risk discussions with system stakeholders
• Leadership briefings initiated

Tier 3 — Red: Executive Review / Executive Oversight

Unsatisfactory remediation progress from Tier 2, deteriorating cyber posture, or material cybersecurity concerns.

Triggers:

• Unsatisfactory remediation progress from Tier 2
• Deteriorating cyber posture
• Material cybersecurity concerns identified

Actions Taken:

• Executive risk reviews convened
• Increased reporting frequency and detail
• Formal accountability sessions with system leadership
• Participation required in CMS governance processes (TLC/TRB)
• Heightened monitoring and scrutiny

Tier 4 — Black: Authorization Revoked

Unacceptable risk resulting in revocation of authorization.

Triggers:

• Persistent failure to meet OA expectations
• Incomplete corrective actions from Tier 3
• Sustained unacceptable risk posture
• Poor engagement with Leadership and OA Team

Outcomes:

• CMS CISO and/or Authorizing Official (AO) terminates OA participation
• System will be retired
• Systems must go through the TLC and governance process to create a new system

Future Roadmap

The OA Program, in partnership with the CRM team, is focused on expanding CDM capabilities, enhancing telemetry coverage, increasing automation, and broadening participation:

Expanding Beyond AWS

As the OA Program continues onboarding AWS-hosted systems, the expansion strategy will evolve to incorporate:

• Additional cloud platforms
• Hybrid environments
• Systems with integrated SaaS components
• SaaS Security Posture Management (SSPM) tooling

This expansion will enhance risk visibility across the broader enterprise technology landscape by enabling consistent assessment of security posture, configuration risks, control effectiveness, and emerging exposures.

Conclusion

The CMS Ongoing Authorization Program represents a fundamental evolution in how CMS manages cybersecurity risk across the enterprise. Through automated data integration, structured governance, and executive engagement, Ongoing Authorization transforms compliance from a recurring obligation into a continuous capability that strengthens resilience, accountability, and mission assurance.

As CMS expands beyond pioneer systems and continues advancing the Risk Engine, telemetry, and automation capabilities, the program is building a sustainable framework that enables proactive risk management and positions CMS to adapt effectively to an ever-changing cyber threat landscape.

Key Definitions

Initial ATO

Initial authorization means the initial risk determination and risk acceptance decision based on a zero-base review of the information system conducted prior to entering the operations or maintenance phase of the system development life cycle. The zero-base review includes an assessment of all security and privacy controls contained in an information system security plan or in a privacy plan and implemented within an information system or the environment in which the system operates.

Ongoing Authorization (OA)

OA means the risk determinations and risk acceptance decisions subsequent to the initial authorization, taken at agreed-upon and documented frequencies in accordance with the agency's mission or business requirements and agency risk tolerance. Ongoing authorization is a time-driven or event-driven authorization process whereby the authorizing official is provided with the necessary and sufficient information regarding the security and privacy state of the information system to determine whether the mission or business risk of continued system operation is acceptable.

Continuous Monitoring / Continuous Assessment

Refers to the compendium of methods, tools, and techniques supporting Information Security Continuous Monitoring (ISCM) used for maintaining ongoing awareness of information security (and privacy), vulnerabilities, threats, and incidents to support agency risk management decisions. At CMS, this is supported by the CDM (Continuous Diagnostics and Mitigation) Program.