ato-package

ATO Package Assembly

This skill collects, validates, and indexes all Authority to Operate submission artifacts into a review-ready package for ISSO review.

When to Use

• Before submitting a system for ISSO review
• When preparing an ATO package for a new or updated system
• When asked "is the compliance package complete?"
• After completing risk assessment, pre-deployment checks, and decision records

Assembly Procedure

Step 1: Artifact Inventory

Check which required artifacts exist in the target repository:

• AGENTS.md — behavioral contract defining agent permissions and constraints
• docs/risk-assessment.md — completed risk assessment (not the template)
• docs/adr/ directory with at least ADR-001 — architecture decision records
• checklists/pre-deployment.md — completed checklist with sign-off
• docs/CODING_PRACTICES.md — coding standards and practices
• SECURITY.md — vulnerability disclosure policy
• .github/workflows/ — CI/CD pipeline definitions

For each artifact, record: exists (yes/no), last modified date, file size.

If an artifact is missing, note it as a gap and continue. Do not stop the assembly process for missing items — the gap analysis in Step 4 will capture them.

Step 2: Validate Artifacts

Run validators on each artifact that exists:

# Validate risk assessment structure and completeness
make validate-risk-assessment RISK_PATH=docs/risk-assessment.md

# Validate frontmatter, skills, and landscape references
make validate

# Run pre-deployment security checks
make pre-deploy

Record the pass/fail result of each validator. If a validator is not available in the target repo, note "validator not available" and flag for manual review.

For docs/risk-assessment.md, also verify:

• All sections are filled in (not placeholder text)
• Risk scores are calculated (Likelihood x Impact)
• Treatment plans exist for Medium (6+) and above risks
• Sign-off section has names and dates

For checklists/pre-deployment.md, also verify:

• All checklist items have a Pass/Fail/N/A status
• Failed items have remediation notes
• Sign-off block at the bottom is completed