Air Force ATO Requirements
A working checklist of what an Air Force Authority to Operate package needs, organized by Risk Management Framework step. Tick items off as your team completes them. Progress is saved in this browser only. Each step ends with fill-in templates and a worked example you can copy.
0 of 0 complete
Sources and references
- AFI 17-101 with 2024 DAFGM (RMF for DAF IT)
- DAFI 17-101 AFRL Supplement (Aug 2025), an example of a local supplement
- NIST SP 800-37 Rev 2 (RMF) and NIST SP 800-53 Rev 5 (controls)
- DoDI 8510.01, DoDI 8500.01, CNSSI 1253, FIPS 199 and AFI 17-130 are also cited by AF RMF guidance. Pull current copies from the DoD and AF publication sites.
Notice: This is a planning aid compiled from public guidance, not an official AF product. Required artifacts, templates and the eMASS workflow vary by Authorizing Official, system categorization and local supplement. Confirm with your ISSM and Security Control Assessor before relying on it. Templates and examples are generic starting points with fictional values, not official AF forms; use your AO or eMASS templates where they exist. The appearance of links or software on this site should not be considered endorsement by the CoE or the DoW.