What is the difference between a JAB authorization and an Agency ATO?

A JAB Provisional Authority to Operate (P-ATO) is issued by the FedRAMP Joint Authorization Board, comprising Chief Information Officers from the Department of Defense, the Department of Homeland Security, and the General Services Administration. This authorisation signifies that a Cloud Service Offering (CSO) has undergone a rigorous technical review and meets FedRAMP requirements for a High or Moderate impact level. The P-ATO is not a full ATO but a provisional approval that federal agencies can leverage as the basis for their own agency-specific ATOs, significantly streamlining the authorisation process for multiple agencies. Achieving a JAB P-ATO is often seen as a strong market differentiator due to the extensive validation and multi-agency endorsement.

An Agency ATO, in contrast, is granted by an individual federal agency for its specific use of a CSO. While it also signifies that the CSO meets FedRAMP requirements at a specified impact level (Low, Moderate, or High), its initial scope is limited to that single agency's use case. However, once a CSO achieves an Agency ATO, it is listed in the FedRAMP Marketplace as 'FedRAMP Authorised,' allowing other federal agencies to review the existing authorisation package and grant their own ATOs based on that package. Practitioners should understand that while an Agency ATO is specific to one agency, it still provides a reusable foundation for other agencies, similar to a JAB P-ATO, but without the initial multi-agency consensus.