Assessment of a Model‐Based Approach to Achieve Authorization to Operate

Accreditation of United States Government (USG) Information Systems (IS) is required to assure their function and security before delivery to the operational environment. However, in many cases, the baseline document‐based accreditation processes are sources of cost and schedule overruns. This results in delays in providing critical information or functionality to USG stakeholders and users. A more modern approach, leveraging Digital Engineering (DE) and using Model‐Based Systems Engineering (MBSE) practices, has the potential to reduce cost and risk of schedule overrun. This paper investigates the costs and benefits of the application of MBSE to the default document‐centric Authorization to Operate (ATO) process. The ATO is a required accreditation process for all USG IS that seek to run in an operational environment. This research builds formal SysML models of the ATO, NIST Risk Management Framework, and a representative IS (a cloud‐native asset management application). These models and their interactions are then assessed relative to default document‐centric processes for their ability to quantitatively improve the results of the accreditation process, specifically by (1) improving the identification and resolution of inconsistencies in requirements management, (2) improving the schedule and cost for accreditation through parameterization and automatic generation of required documentation directly from SysML models. The results illustrate that an MBSE‐enabled ATO process has significant benefits in identifying and addressing common ATO errors in requirements validation. Problems with inconsistencies, mislabeled requirements, erroneous “copy and paste,” and errors in requirements traceability that are ubiquitous in document‐centric ATO artifacts are driven to zero under the model‐based ATO process due to the error‐checking tools included in modern MBSE software. Improvements in the accreditation schedule and effort were found in the model‐based ATO process because of the reuse of security controls, and the large degree of automatic generation of ATO artifacts. Publicly available security control models for > 1000 NIST SP800‐ 53 Revision security controls were developed and demonstrated, and 20 of the 41 ATO documents/artifacts generally required for accreditation or systems development of the representative IS were demonstrated to be parametrically definable and auto‐generatable using tools available in modern MBSE software packages. Discussion focuses on the costs and benefits of this model‐driven approach for contemporary and future USG IS. This work is novel in that the artifacts of a model‐based ATO have not previously been developed, and that the costs and benefits of model‐driven accreditation have not been previously asserted, investigated or analyzed. Significance and Practitioner Points This paper establishes that applying Model‐Based Systems Engineering (MBSE) to the Authorization to Operate (ATO) process fundamentally transforms a traditionally slow, laborious, error‐prone, document‐centric workflow into a more consistent, automated, and analyzable digital system. For researchers, the work provides a novel, rigorously modeled integration of SysML representations of both the ATO process and an example Information System (IS), offering the first quantified evidence that MBSE can reduce, and potentially, eliminate requirements traceability errors, enable full consistency of security controls, and reduce documentation effort by over 30%, thereby establishing a foundation for further empirical and methodological advances in digital accreditation. For practitioners, the key takeaway is pragmatic: although initial model development requires investment, an MBSE‐enabled ATO approach can dramatically reduce rework, prevent common documentation and compliance errors, accelerate accreditation timelines, and enable scalable reuse of security artifacts—ultimately lowering cost, improving quality, and better aligning ATO processes with modern cloud‐based and DevSecOps environments.