Federal Emergency Management Agency

Authority to Operate (ATO) is the formal decision by an agency's Authorizing Official that an IT system's security risk is acceptable, based on assessed controls under the NIST Risk Management Framework, clearing it to go live and process government data. Without an ATO, a system, however well-built, cannot operate on a federal network.

A Broad Agency Announcement (BAA) is a competitive solicitation method under FAR 35.016 that agencies use to acquire basic and applied research (rather than a specific system or hardware solution) by describing broad areas of interest and evaluating proposals through scientific or peer review instead of standard best-value scoring. Common at DARPA, AFRL, and other research-heavy agencies.

A Contracting Officer's Technical Representative (COTR), now more commonly called a COR, is the government employee a Contracting Officer designates to monitor a contractor's technical performance, verify deliverables, and flag issues, without authority to change contract price, scope, or terms. That authority stays solely with the Contracting Officer.

The Defense Advanced Research Projects Agency (DARPA) is the DoD agency that funds high-risk, high-payoff research to create breakthrough technologies for national security, from the early internet to stealth aircraft to autonomous systems. It typically contracts through BAAs and other transaction agreements with industry and academia rather than traditional procurement.

The Defense Contract Audit Agency (DCAA) is the DoD agency that audits contractor costs, accounting systems, and incurred cost proposals to confirm charges billed to government contracts are allowable, allocable, and reasonable. Its findings directly affect contract negotiations, closeouts, and a contractor's ability to hold cost-reimbursement work.