Help Desk: (814)865-HELP security@psu.edu

Authority to Operate

All stored information classified as "Restricted" or High" under University Policy AD95 requires an Authority to Operate (ATO).

Who needs an Authority to Operate (ATO)?

Anyone who stores or processes information classified as “Restricted” or “High” under University Policy AD95 must have an Authority to Operate.

How do I obtain an Authority to Operate?

To begin the ATO process, complete this ServiceNow form. A member of the Office of Information Security will contact you. That person will determine whether the information is properly secured (typically, this is done in a security enclave) and meets compliance requirements. Once OIS grants approval, your unit will receive an authority to operate.

Do I need an ATO if my information resides in a Security Enclave?

Yes, Security Enclaves require an Authority to Operate. To learn more about Security Enclaves, please check our Enclave page.