Provisional Authorization

In cybersecurity frameworks, a provisional authorization is a temporary or conditional approval to operate a system while certain security conditions are still being met. In the CMMC context, this relates to conditional certification where a contractor may receive a provisional status while closing out POA&M items within the allowed 180-day window.

This concept also applies in FedRAMP, where cloud service providers receive a Provisional Authority to Operate (P-ATO) from the Joint Authorization Board before individual agencies grant their own ATOs.