Understand Authorization to Operate & Authorization Package

Deploying secure applications into Department of War (DOW) environments requires strict compliance with cybersecurity and authorization standards. Game Warden simplifies this process through its existing Authorization to Operate (ATO), allowing your organization to inherit this authorization through a structured pathway.

This guide explains how Game Warden's ATO, Authorization Package, and Software Approval work together to enable compliant deployments.

Key terms at a glance

These are the four terms used throughout the Game Warden authorization process (ATO, ATO Inheritance, Software Approval, and Authorization Package). Each entry explains what the term means and why it matters to your deployment.

What it means: A government-issued authorization that allows your system to operate on DOW networks.
Why it matters: Required to deploy to any DOW environment. Game Warden holds an ATO for Impact Levels (IL) 2, 4, and 5, authorized through AFWERX. Applications hosted on Game Warden may inherit this ATO.

How the process works

Getting a Software Approval for your app on Game Warden takes five steps, from building the app to receiving approval to deploy.

Build and prepare your app

You build your application and prepare it for deployment to Game Warden.

Harden and scan

Game Warden helps you harden and scan your application, generating the evidence of security posture that goes into the Authorization Package.

Upload the body of evidence

The Game Warden team uploads the body of evidence from step 2 into the Authorization Package section of the Documents page in the Game Warden app. Optionally, you can submit additional compliance evidence or external ATOs.

Submit for review

Game Warden sends the Authorization Package to an authorizing official or delegated authority for review and approval.

Receive Software Approval

Once the Authorization Package is approved, you are issued a Software Approval. This approval allows your app to inherit Game Warden's ATO and be deployed to staging (STG) and production (PRD) environments.

Danger

The ATO is non-transferable and only valid for Game Warden-hosted applications.

Required components for the Authorization Package

Include the following components in your Authorization Package when requesting a Software Approval:

Authorization Boundary Diagram—A visual representation of your application architecture that shows all components, data flows, containers, and external services. It must show the direction of data movement (ingress, egress, or bidirectional) and the ports and protocols in use. This diagram verifies that your deployment aligns with ATO requirements. For more information, see Authorization Boundary Diagram.
Body of Evidence (BoE)—A detailed form completed within the Game Warden app that describes how your application meets ATO controls. It includes system architecture, data handling practices, external approvals (if applicable), and proof of an active government contract. The Game Warden security team reviews and approves the BoE. For more information, see Body of Evidence.
Security Findings Summary—A document containing hyperlinks to vulnerability scan results exported from Findings. It provides a snapshot of your application's security posture.
ISSM Critical/High/Stop Security Findings Memo (if applicable)—A waiver memo addressing critical or high Common Vulnerabilities and Exposures (CVEs) that you cannot remediate before deployment. It must justify the proposed risk mitigation strategy and is subject to review by Game Warden and government reviewers.
Game Warden Authority to Operate Documentation—A copy of Game Warden's signed ATO issued by an Authorizing Official (AO) for the Impact Level (IL) targeted by your deployment.
Optional Documentation—You may include supporting materials, such as an existing ATO from another AO or other compliance evidence relevant to your system.

Note

Game Warden engineers help generate many of these artifacts as part of the security hardening and image scanning process.

Update your Authorization Package

You should update your Authorization Package and BoE under the following conditions:

Annually, or
Whenever a major release occurs, such as:
- Adding or removing containers
- Introducing new services or external connections
- Modifying your Authorization Boundary Diagram

After updating your BoE, the Game Warden Security team will generate the remaining components, including updated scan results.

Note

You do not need a new Authorization Package for minor releases, such as:

Updating existing containers
Changing internal networking
Applying non-breaking patches

FAQs

How to define a major vs. minor release?

A major release involves changes to your application that require review and approval by the Authorizing Official (AO) and an updated Authorization Package. Examples include:

Changes to the Authorization Boundary Diagram, such as adding or removing containers
Adding new services
Modifying external communications

A minor release includes updates that do not require a new Authorization Package, such as:

Changes to internal container networking
Updating existing containers

How does the Software Approval process work for new releases?

If your new release stays within the scope of your approved Authorization Package and follows the Game Warden Software Development Life Cycle (SDLC), the existing Software Approval can often be amended rather than reissued.

To qualify, your application must still meet the compliance requirements defined by the Director of Security and the Authorizing Official (AO).

If these conditions are met, the updated version of your application can be added to the existing Software Approval without requiring a full re-approval.

The Game Warden security team will review the release and determine whether a new Software Approval is necessary based on the scope and impact of your changes.