Defense Contract Audit Agency

Authority to Operate (ATO) is the formal decision by an agency's Authorizing Official that an IT system's security risk is acceptable, based on assessed controls under the NIST Risk Management Framework, clearing it to go live and process government data. Without an ATO, a system, however well-built, cannot operate on a federal network.

A Broad Agency Announcement (BAA) is a competitive solicitation method under FAR 35.016 that agencies use to acquire basic and applied research (rather than a specific system or hardware solution) by describing broad areas of interest and evaluating proposals through scientific or peer review instead of standard best-value scoring. Common at DARPA, AFRL, and other research-heavy agencies.

A Contracting Officer's Technical Representative (COTR), now more commonly called a COR, is the government employee a Contracting Officer designates to monitor a contractor's technical performance, verify deliverables, and flag issues, without authority to change contract price, scope, or terms. That authority stays solely with the Contracting Officer.

The Defense Advanced Research Projects Agency (DARPA) is the DoD agency that funds high-risk, high-payoff research to create breakthrough technologies for national security, from the early internet to stealth aircraft to autonomous systems. It typically contracts through BAAs and other transaction agreements with industry and academia rather than traditional procurement.

The Defense Information Systems Agency (DISA) is the DoD combat support agency that builds, operates, and secures the department's information technology and communications infrastructure (networks, cloud, and command-and-control systems) for warfighters and defense leadership worldwide. It's a major buyer of IT and cybersecurity services from contractors.