18F: Digital service delivery | Taking the ATO process from 6 months to 30 days

<!DOCTYPE html> <html lang="en-US"> <head>  <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" />  <meta name="HandheldFriendly" content="True" /> <meta name="MobileOptimized" content="320" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" />  <title>18F: Digital service delivery | Taking the ATO process from 6 months to 30 days</title> <meta property="og:title" content="18F: Digital service delivery | Taking the ATO process from 6 months to 30 days" /> <meta name="description" content="" /> <meta property="og:description" content="" /> <meta name="twitter:card" content="summary" /> <meta name="twitter:site" content="@18F" /> <meta name="twitter:title" content="Taking the ATO process from 6 months to 30 days" /> <meta name="twitter:description" content="" /> <meta property="og:type" content="article" /> <link rel="canonical" href="/2018/07/19/taking-the-ato-process-from-6-months-to-30-days/" /> <meta property="og:url" content="/2018/07/19/taking-the-ato-process-from-6-months-to-30-days/" /> <script async="" src=/assets/js/uswds-init.js></script>  <link rel="icon" type="image/png" sizes="16x16" href="/img/favicons/favicon-16x16.png"> <link rel="icon" type="image/png" sizes="32x32" href="/img/favicons/favicon-32x32.png"> <link rel="icon" type="image/png" sizes="192x192" href="/img/favicons/favicon-192x192.png"> <link rel="icon" type="image/svg+xml" href="/img/favicons/favicon.svg"> <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" /> <link rel="apple-touch-icon" sizes="180x180" href="/img/favicons/favicon-180x180.png">  <link href="https://unpkg.com/prismjs@1.20.0/themes/prism.css" rel="stylesheet"> <link rel="preload" as="style" href="/assets/styles/styles-UKMOJPRN.css" /> <link rel="stylesheet" href="/assets/styles/styles-UKMOJPRN.css" type="text/css" /> </head> <body class=" "> <a class="usa-skipnav" href="#main-content">Skip to main content</a> <div class="page-landing-page layout-demo "> <a class="usa-skipnav" href="#main-content">Skip to main content</a> <div class="usa-banner"> <div class="usa-accordion"> <section id="gov-banner-header-section" aria-label="USA Gov banner section header" class="usa-banner__header" > <div class="usa-banner__inner"> <div class="grid-col-auto"> <img src="/img/us_flag_small-VKjpzbKpq_.png" class="usa-banner__header-flag" alt="U.S. flag" loading="lazy" decoding="async"> </div> <div class="grid-col-fill tablet:grid-col-auto"> <p class="usa-banner__header-text"> An official website of the United States government </p> <p class="usa-banner__header-action" aria-hidden="true"> Here’s how you know </p> </div> <button class="usa-accordion__button usa-banner__button" aria-expanded="false" aria-controls="gov-banner" type="button" > <span class="usa-banner__button-text">Here's how you know</span> </button> </div> </section> <div class="usa-banner__content usa-accordion__content" id="gov-banner"> <div class="grid-row grid-gap-lg"> <div class="usa-banner__guidance tablet:grid-col-6"> <div class="usa-media-block__body"> <p> <strong>The .gov means it’s official.</strong> <br /> Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site. </p> </div> </div> <div class="usa-banner__guidance tablet:grid-col-6"> <div class="usa-media-block__body"> <p> <strong>The site is secure.</strong> <br /> The <strong>https://</strong> ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely. </p> </div> </div> </div> </div> </div> </div> <div class="usa-overlay"></div> </div> <header class="usa-header usa-header--basic usa-header--basic-megamenu" role="banner"> <div class="usa-nav-container"> <div class="usa-navbar"> <div class="usa-logo" id="header-logo"> <a href="/" title="Home"> <img src="/img/18f-logo-60i14872OF.svg" class="usa-logo-img" alt="18F home page" loading="lazy" decoding="async"> </a> </div> <button type="button" class="usa-menu-btn">Menu</button> </div> <nav class="usa-nav" aria-label="Menu navigation" > <button type="button" class="usa-nav__close"> <img src="/img/close-xPu02brD0d.svg" class="" alt="close" loading="lazy" decoding="async"> </button> <ul class="usa-nav__primary usa-accordion"> <li class="usa-nav__primary-item"> <a class="usa-nav__link " href="/our-work/" > <span>Our work</span> </a> </li> <li class="usa-nav__primary-item"> <a class="usa-nav__link " href="/work-with-us/" > <span>Work with us</span> </a> </li> <li class="usa-nav__primary-item"> <a class="usa-nav__link " href="/about/" > <span>About 18F</span> </a> </li> <li class="usa-nav__primary-item"> <a class="usa-nav__link " href="/guides/" > <span>Guides</span> </a> </li> <li class="usa-nav__primary-item"> <a class="usa-nav__link usa-current " href="/blog/" > <span>Blog</span> </a> </li> <li class="usa-nav__primary-item"> <a class="usa-button an18f-button--dark margin-top-3 desktop:margin-top-0 desktop:margin-x-2 " href="/contact/" > <span>Contact</span> </a> </li> </ul> <a href="https://search.usa.gov/search?utf8=%E2%9C%93&affiliate=18F-site&query=&commit=" class="usa-button padding-x-2" > <img src="/img/search--white-ZVwKBtv5eC.svg" class="" alt="Search" loading="lazy" decoding="async"> </a> </nav> </div> </header> <main id="main-content"> <article id="main-content" class="post-article margin-top-6" itemscope itemtype="http://schema.org/BlogPosting"> <div class="grid-container"> <div class="grid-row"> <div class="tablet:grid-col-12"> <header> <h1 itemprop="name headline">Taking the ATO process from 6 months to 30 days</h1> <p class="margin-top-1"> Published on <time datetime="Thu Jul 19 2018 00:00:00 GMT+0000 (Coordinated Universal Time)" itemprop="datePublished">July 19, 2018</time> </p> <span class="post-tags display-flex flex-wrap" itemprop="keywords"> <a href="/tags/security/" class="usa-label post-tag"> security </a> <a href="/tags/lessons-learned/" class="usa-label post-tag"> lessons learned </a> <a href="/tags/how-we-work/" class="usa-label post-tag"> how we work </a> </span> </header> </div> </div> <hr class="hr-1-dark"> <div class="grid-row grid-gap margin-top-8"> <div class="tablet:grid-col-7"> <div class="post-content" itemprop="articleBody"> <p>Security compliance is a major factor in launching a software system in the federal government, in terms of technology choices, and even more importantly, time and effort. The Authority To Operate compliance process for systems within our division of the General Services Administration (GSA) was taking more than six months for every system, with a long and growing backlog. <strong>With the new process, we have cleared the backlog and reduced the turnaround time to under a month.</strong> We think that deserves a celebration and makes for a good opportunity to share the lessons we’ve learned.</p> <p><em>If you're reading this and thinking "My work has nothing to do with ATOs," don't despair! Even outside of security compliance, the Sprinting Team model can work well when you have a handful of disparate people who are otherwise asynchronously involved in a time-intensive, complex process with a clear target. For example: a long list of job applicants to review, procurements to complete, etc.</em></p> <h2 id="background" tabindex="-1">Background<a href="#background" class="heading-permalink" aria-label="Permalink for this section"><svg class="usa-icon" aria-hidden="true" focusable="false" role="img"><use xlink:href="#svg-link"></use></svg></a></h2> <p>Every federal information system must go through the Risk Management Framework created by the National Institute of Standards and Technology before it can be used to process federal information. This process culminates in an agency issuing a signed Authority to Operate (ATO) for that system. Basically, that ATO certifies that an authorized person has said “yes, I trust that this system and team are doing their due diligence security-wise, and I am ok with the inherent risk of launching it.” Getting there is colloquially known as “the ATO process”.</p> <p>One year ago, the Technology Transformation Services (TTS) had 25-30 systems (of varying sizes) that needed new ATOs: some were expired or expiring, some had only completed part of the process, some hadn’t been considered part of our system inventory, etc. ATOs across government have traditionally taken 6-18 months, with a lot of slow back-and-forth between system owners and the assessors. The ATO Sprinting Team brought the assessors and the project teams "into a [virtual] room" for focused sprints to get through one ATO at a time, with near-full-time focus.</p> <p>Under the ATO Sprinting Team, <strong>our ATOs have gone down from more than six months to under a month</strong>.</p> <h2 id="how-did-we-get-there" tabindex="-1">How did we get there?<a href="#how-did-we-get-there" class="heading-permalink" aria-label="Permalink for this section"><svg class="usa-icon" aria-hidden="true" focusable="false" role="img"><use xlink:href="#svg-link"></use></svg></a></h2> <p>18F launches new software all the time, and since ATOs are such a big part of doing so, we’ve identified a number of ways to make ATOs faster:</p> <ul> <li> <p><strong>Reduce the complexity of the system.</strong> The larger the system, the larger and more complex the ATO “packages” (documentation) will be. This makes them harder to create and harder for assessors to evaluate. The smaller the systems, timeframes, and packages, the easier for everyone.</p> </li> <li> <p><strong>More focused process.</strong> There is a <a href="https://www.apa.org/research/action/multitask.aspx" class="usa-link usa-link--external" rel="noreferrer">switching cost</a> when people try to multitask; this applies to our project teams trying to do their ATO while doing feature development and assessors reviewing multiple systems at once. The more focused everyone involved is on the ATO, the fewer the human-hours to complete it.</p> </li> <li> <p><strong>Use consistent tooling and processes.</strong> Assessors are there to ensure the system meets the compliance requirements, and to do so, they need to understand what’s going on in the system. If every system they look at is using an entirely different framework, infrastructure, or monitoring, it’s harder for them to assess. By <a href="https://before-you-ship.18f.gov/">documenting our standard security practices</a> and <a href="https://before-you-ship.18f.gov/ato/checklist/">ensuring teams follow them</a> before they enter assessment, we:</p> <ul> <li>Avoid reinventing the wheel for every system</li> <li>Reduce the learning curve to understand each system for assessors</li> </ul> </li> <li> <p><strong>More inheritance.</strong> As noted in the “smaller” and “more consistent” bullets above, the more custom parts of the system, the more complex the ATO process. The more we <a href="/2018/03/27/four-benefits-to-using-the-full-TTS-tech-stack/">reuse a proven technology stack</a> the fewer security requirements need to be addressed by the system under evaluation.</p> <ul> <li>By standardizing <a href="https://before-you-ship.18f.gov/security/mfa/">a few ways to do user authentication</a>, each system doesn’t have to assess a new technology for the same functionality.</li> <li>By leveraging <a href="https://cloud.gov">cloud.gov</a> for (nearly) all of our backend code and databases, we cut out a <em>huge</em> amount of operational and <a href="https://cloud.gov/docs/compliance/ato-process/">compliance</a> burden.</li> <li>Sites deployed on <a href="https://federalist.18f.gov">Federalist</a> can be <a href="https://federalist-docs.18f.gov/pages/about-federalist/why-use-federalist/">folded in to the Federalist ATO</a>. <strong>Sites on Federalist can be assessed and authorized in a matter of days.</strong></li> </ul> </li> <li> <p><strong>More integration between security and project teams.</strong> Similar to “more focused” above, having all ATO process interactions happen asynchronously over email means that open questions and blockers can’t be resolved right away, and details can be lost. Having the security team / assessors working alongside the project team in real time means that these issues can get resolved quickly, and the entire process is more collaborative.</p> </li> </ul> <p>To implement these, we needed a well-functioning team. Here’s how it was structured:</p> <h2 id="roles" tabindex="-1">Roles<a href="#roles" class="heading-permalink" aria-label="Permalink for this section"><svg class="usa-icon" aria-hidden="true" focusable="false" role="img"><use xlink:href="#svg-link"></use></svg></a></h2> <p>The Sprinting Team consisted of:</p> <ul> <li> <p><strong>Security.</strong> This usually consisted of someone who focused on the documentation and assessment of the overall system, as well as a penetration tester.</p> </li> <li> <p><strong>The System Owner.</strong> This was generally a TTS developer on the project team who had a good understanding of the system going through the process, who can:</p> <ul> <li>Answer questions about the system</li> <li>Fix things as they come up, or at least take those issues to the appropriate person</li> </ul> </li> <li> <p><strong>An Infrastructure Lead.</strong> A TTS team member with ATO experience who can help with preparation for the assessment, and translate between Security and the System Owner.</p> </li> </ul> <p>We were able to get Security members involved across multiple sprints, so they would learn with us, participate in retros, and be able to act on those outcomes.</p> <h2 id="tracking" tabindex="-1">Tracking<a href="#tracking" class="heading-permalink" aria-label="Permalink for this section"><svg class="usa-icon" aria-hidden="true" focusable="false" role="img"><use xlink:href="#svg-link"></use></svg></a></h2> <p>The Infrastructure Leads keep a <a href="/2016/08/31/kanban-for-government/">kanban</a> board to track the status of ATOs:</p> <figure> <a href="/assets/blog/ato/ato-kanban.png"> <img src="/assets/blog/ato/ato-kanban.png" alt=Screenshot of the ATO Kanban board on GitHub. /> </a> </figure> <p>Systems are prioritized based on their launch deadlines, whether they have an existing ATO that’s expiring, and preparedness of the project team. We limit ourselves to at most one ATO in active assessment at any given time.</p> <p>We also keep track of system launch dates, to make sure we’re getting ahead on ATOs before it’s a time crunch. <strong>The ATO Sprinting Team model was focused as much on reducing the passive time an ATO <em>wasn’t</em> getting done as the active time working on it.</strong></p> <h2 id="artifacts" tabindex="-1">Artifacts<a href="#artifacts" class="heading-permalink" aria-label="Permalink for this section"><svg class="usa-icon" aria-hidden="true" focusable="false" role="img"><use xlink:href="#svg-link"></use></svg></a></h2> <p>As systems move through the ATO process, we learn more and more about what works well for systems compliance-wise.</p> <p>Almost all of the systems run on top of <a href="https://cloud.gov">cloud.gov</a>, a Platform-as-a-Service with a FedRAMP authorization, which handles a lot of the compliance at the platform level. For the parts that are the responsibility of the customer system, we worked with GSA Security to develop a <a href="https://before-you-ship.18f.gov/ato/ssp/">System Security Plan (SSP)</a> template for systems running on <a href="https://cloud.gov">cloud.gov</a>, which cut out the security controls handled by the platform.</p> <p>Working in the constraints of what Software-as-a-Service was approved or could be <a href="https://github.com/GSA/data/tree/master/enterprise-architecture#readme" class="usa-link usa-link--external" rel="noreferrer">approved for use at GSA</a>, we also standardized tools, procedures, and control language around:</p> <ul> <li><a href="https://before-you-ship.18f.gov/infrastructure/">Hosting</a></li> <li><a href="https://before-you-ship.18f.gov/ato/ssp/#systemnetwork-diagrams">Architecture diagrams</a></li> <li><a href="https://before-you-ship.18f.gov/infrastructure/good-production-practices/#deployment">CI/CD</a></li> <li><a href="https://before-you-ship.18f.gov/security/static-analysis/">Vulnerability scanning</a></li> <li><a href="https://before-you-ship.18f.gov/security/frameworks/">Framework configuration</a></li> <li><a href="https://before-you-ship.18f.gov/infrastructure/logging/">Logging</a></li> </ul> <p>We have the advantage of building and launching systems constantly, so we have lots of opportunity to learn and iterate on the ATO process.</p> <h2 id="challenges" tabindex="-1">Challenges<a href="#challenges" class="heading-permalink" aria-label="Permalink for this section"><svg class="usa-icon" aria-hidden="true" focusable="false" role="img"><use xlink:href="#svg-link"></use></svg></a></h2> <p>There were a handful of issues we ran into:</p> <ul> <li><strong>Experience.</strong> Every System Owner going through our ATO process was doing so for the first time. This meant that they don’t know how to fill out System Security Plans, what a security control is, what happens during a penetration test, etc. On top of that, security compliance can be frustrating because of its complex requirements and jargon. This meant the Infrastructure Leads had to not only be knowledgeable about security compliance, but also be patient coaches.</li> <li><strong>Measurement.</strong> ATO processes are largely human, so gathering data about the start and stop of each stage for every system to date took hours of combing through dialogue in our chat and email conversations, kanban board, and PDFs of signed ATOs.</li> <li><strong>Communication.</strong> The ATO Sprinting Team would constantly improve the process and guidance as we went, but System Owners weren’t always aware of the changes, and would sometimes get frustrated at moving targets.</li> </ul> <h3 id="things-to-watch-out-for" tabindex="-1">Things to watch out for<a href="#things-to-watch-out-for" class="heading-permalink" aria-label="Permalink for this section"><svg class="usa-icon" aria-hidden="true" focusable="false" role="img"><use xlink:href="#svg-link"></use></svg></a></h3> <p>If you are at another agency and are interested in applying the principles of an ATO Sprinting Team, make sure to:</p> <ul> <li><strong>Get buy-in from the Security team.</strong> We were lucky to have willing and capable partners in GSA Security. A Sprinting Team only works if all the stakeholders are willing participants.</li> <li><strong>Get people dedicated to working on this.</strong> Our Infrastructure Leads have to understand the process, make judgement calls, and shepherd project teams through. You need people able and willing to commit the time.</li> <li><strong>Think of ways to measure.</strong> As mentioned earlier, we didn’t think about metrics early enough, so determining our success quantitatively was a backwards-looking, manual process. Determine your success metrics early, implement the collection early, establish a baseline, and review them regularly.</li> </ul> <h2 id="the-results" tabindex="-1">The results<a href="#the-results" class="heading-permalink" aria-label="Permalink for this section"><svg class="usa-icon" aria-hidden="true" focusable="false" role="img"><use xlink:href="#svg-link"></use></svg></a></h2> <p>As mentioned above, we have been dramatically improving the time to ATO:</p> <figure> <img src="/img/ato-completion-date-graph-8Q1PV0mdzr.png" class="" alt="Graph showing ATO completion timeline with starting date on the x- axis, and the dates to complete on the y-axis. There is a clear trend downward." loading="lazy" decoding="async"> </figure> <p><em>“ATO effort started on” is measured from when we acknowledged “this system needs an ATO” and created a card in our Backlog. “Days to complete ATO” is measured from the card creation time to when the ATO letter is signed.</em></p> <p>Congrats to the Sprinting Team for clearing the backlog, our GSA Security counterparts for being so great to work with, and all the systems that went through for achieving compliance!</p> <h2 id="see-also" tabindex="-1">See also<a href="#see-also" class="heading-permalink" aria-label="Permalink for this section"><svg class="usa-icon" aria-hidden="true" focusable="false" role="img"><use xlink:href="#svg-link"></use></svg></a></h2> <ul> <li><a href="https://before-you-ship.18f.gov/">Before You Ship</a> - 18F’s guide to ATOs and Infrastructure</li> <li><a href="/2017/02/27/to-get-things-done-you-need-great-secure-tools/">“To get things done, you need great, secure tools”</a> blog post</li> <li><a href="https://www.fedramp.gov/assets/resources/documents/FedRAMP_Accelerated_A_Case_Study_For_Change_Within_Government.pdf">FedRAMP Accelerated</a></li> <li><a href="https://boise.18f.gov/">Project Boise</a> - discovery on compliance processes across government</li> <li><a href="https://cloud.gov/overview/security/conforming-federal-security-regulations/">How cloud.gov helps teams comply with requirements</a></li> </ul> </div> </div> <aside class="tablet:grid-offset-1 tablet:grid-col-4"> <div class="bg-primary-darker padding-3 text-white usa-dark-background radius-md"> <h2 class="font-sans-lg text-bold margin-bottom-2">Follow 18F</h2> <ul class="usa-list usa-list--unstyled"> <li class="margin-bottom-2"> <a href="https://github.com/18F" class="usa-link--alt usa-link--external" rel="noreferrer" > <img src="/img/github-lightest-dnvvdJeNxl.svg" class="maxw-3 margin-right-2 text-sub" alt="" loading="lazy" decoding="async">18F on GitHub </a> </li> <li class="margin-bottom-2"> <a href="https://twitter.com/18F" class="usa-link--alt usa-link--external" rel="noreferrer" > <img src="/img/twitter-lightest-MyHkS8cnLa.svg" class="maxw-3 margin-right-2 text-sub" alt="" loading="lazy" decoding="async">18F on Twitter </a> </li> <li class="margin-bottom-2"> <a href="https://www.linkedin.com/company/gsa18f" class="usa-link--alt usa-link--external" rel="noreferrer" > <img src="/img/linkedin-lightest-hDYpqtBBKD.svg" class="maxw-3 margin-right-2 text-sub" alt="" loading="lazy" decoding="async">18F on LinkedIn </a> </li> <li class="margin-bottom-2"> <a href="/feed.xml" class="usa-link--alt " > <img src="/img/rss-lightest-29xxdTjXfa.svg" class="maxw-3 margin-right-2 text-sub" alt="" loading="lazy" decoding="async">RSS feed </a> </li> </ul> </div> </aside> </div> </div> </article> <section class="margin-top-6 post-pagination"> <div class="grid-container"> <hr class="hr-1-base-lighter"> <div class="grid-row grid-gap"> <div class="grid-col-6"> <a href="/2018/07/17/five-contracting-tweaks-that-have-yielded-18f-better-procurements/" class="text-no-underline post-pagination__link" > <h2 class="post-pagination__heading"> <svg class="icon caret" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" x="0px" y="0px" width="512px" height="512px" viewBox="0 0 444.531 444.531" style="enable-background:new 0 0 444.531 444.531;" xml:space="preserve" role="img" aria-hidden="true"> <title>Arrow left</title> <desc>Arrow pointing to the left</desc> <g> <path d="M213.13,222.409L351.88,83.653c7.05-7.043,10.567-15.657,10.567-25.841c0-10.183-3.518-18.793-10.567-25.835 l-21.409-21.416C323.432,3.521,314.817,0,304.637,0s-18.791,3.521-25.841,10.561L92.649,196.425 c-7.044,7.043-10.566,15.656-10.566,25.841s3.521,18.791,10.566,25.837l186.146,185.864c7.05,7.043,15.66,10.564,25.841,10.564 s18.795-3.521,25.834-10.564l21.409-21.412c7.05-7.039,10.567-15.604,10.567-25.697c0-10.085-3.518-18.746-10.567-25.978 L213.13,222.409z" fill="#046b99"/> </g> </svg> Previous post </h2> <p class="measure-1 text-bold text-primary-darkest">Five contracting tweaks that have yielded 18F better procurements (thus far)</p> </a> </div> <div class="grid-col-6 text-right"> <a href="/2018/07/26/what-we-learned-from-building-a-pool-of-agile-vendors/" class="text-no-underline post-pagination__link" > <h2 class="post-pagination__heading"> Next post <svg class="icon caret" xmlns="http://www.w3.org/2000/svg" width="444.819" height="444.819" viewBox="0 0 444.819 444.819" role="img" aria-hidden="true"> <title>Arrow right</title> <desc>Arrow pointing to the right</desc> <path fill="#046b99" d="M352.025 196.712L165.885 10.848C159.028 3.615 150.468 0 140.185 0s-18.84 3.62-25.696 10.848l-21.7 21.416c-7.045 7.043-10.567 15.604-10.567 25.692 0 9.897 3.52 18.56 10.566 25.98L231.544 222.41 92.785 361.168c-7.04 7.043-10.563 15.604-10.563 25.693 0 9.9 3.52 18.566 10.564 25.98l21.7 21.417c7.043 7.043 15.612 10.564 25.697 10.564 10.09 0 18.656-3.52 25.697-10.564L352.025 248.39c7.046-7.423 10.57-16.084 10.57-25.98.002-10.09-3.524-18.655-10.57-25.698z"/> </svg> </h2> <p class="measure-1 float-right text-bold text-primary-darkest text-right">What we learned from building a pool of agile vendors</p> </a> </div> </div> <hr class="hr-1-base-lighter"> </div> </section> <section class="margin-top-3 margin-bottom-6"> <div class="grid-container"> <ul class="grid-row grid-gap usa-list--unstyled"> <li class="grid-col-12 tablet:grid-col-6 tablet-lg:grid-col-4 margin-bottom-5 "> <a href="/2015/04/03/how-to-welcome-new-coders-to-a-civic-hackathon/" class="text-no-underline"> <h3 class="border-top-05 border-primary hover-primary-dark padding-top-3 margin-bottom-3 text-bold "> How to welcome new coders to a civic hackathon </h3> </a> The National Day of Civic Hacking is a great time to attend — or host your first hackathon. We’ve outlined some strategies for first-time hackathon hosts to ensure new participants feel welcome, and help them maximize their contributions. </li> <li class="grid-col-12 tablet:grid-col-6 tablet-lg:grid-col-4 margin-bottom-5 "> <a href="/2019/02/07/the-cloud-is-not-a-virtue/" class="text-no-underline"> <h3 class="border-top-05 border-primary hover-primary-dark padding-top-3 margin-bottom-3 text-bold "> Cloud is not a virtue </h3> </a> Federal agencies, like every other industry, are moving to cloud computing for their infrastructure. The economies of scale lead to a number of benefits, but unfortunately, having a server launched in the cloud does not magically make infrastructure better. Government should leverage cloud wisely to yield benefits </li> <li class="grid-col-12 tablet:grid-col-6 tablet-lg:grid-col-4 margin-bottom-5 "> <a href="/2016/06/30/6-ways-a-writing-lab-will-help-your-organization/" class="text-no-underline"> <h3 class="border-top-05 border-primary hover-primary-dark padding-top-3 margin-bottom-3 text-bold "> 6 ways a writing lab will help your organization </h3> </a> Wondering if a writing lab might be right for your organization? Reviewing the benefits 18F has seen from our Writing Lab might help you figure out if starting your own is the way to go. </li> </ul> </div> </div> </section> </main> <footer> <div class="grid-container padding-y-6"> <hr class="hr-1-dark footer-hr-alignment"> <div class="grid-row grid-gap"> <div class="tablet:grid-col-3"> <img src="/img/18f-logo-60i14872OF.svg" class="maxw-5" alt="18F logo" loading="lazy" decoding="async"> <p> Work with us to plan successful projects, choose better vendors, build custom software, or learn how to work in new ways. </p> <a href="/contact/" class="usa-button an18f-button--dark" > Contact us </a> </div> <div class="tablet:grid-offset-1 tablet:grid-col-2"> <h2 class="font-heading-md text-medium margin-top-4 tablet:margin-top-0 margin-bottom-2 tablet:margin-bottom-4"> Pages </h2> <ul class="usa-list usa-list--unstyled font-sans-sm list-item-spacing-2"> <li><a href="/our-work/">Our work</a></li> <li><a href="/work-with-us/">Work with us</a></li> <li><a href="/about/">About 18F</a></li> <li><a href="/guides/">Guides</a></li> <li><a href="/blog/">Blog</a></li> <li><a href="/contact/">Contact</a></li> </ul> </div> <div class="tablet:grid-col-2"> <h2 class="font-heading-md text-medium margin-top-4 tablet:margin-top-0 margin-bottom-2 tablet:margin-bottom-4"> Policies </h2> <ul class="usa-list usa-list--unstyled font-sans-sm list-item-spacing-2"> <li><a href="/linking-policy/">Linking policy</a></li> <li><a href="/open-source-policy/">Open source policy</a></li> <li><a href="/vulnerability-disclosure-policy/">Vulnerability disclosure</a></li> <li><a href="/code-of-conduct/">Code of conduct</a></li> </ul> </div> <div class="tablet:grid-col-2"> <h2 class="font-heading-md text-medium margin-top-4 tablet:margin-top-0 margin-bottom-2 tablet:margin-bottom-4"> Contact </h2> <ul class="usa-list usa-list--unstyled font-sans-sm list-item-spacing-2"> <li> <a href="/contact/" > Get in touch </a> </li> <li> <a href="/about/#for-press" > Press </a> </li> <li> <a href="https://github.com/18F/18f.gsa.gov/issues/new/choose" class="usa-link--external" > Report a bug </a> </li> <li> <a href="/join/" > Join 18F </a> </li> </ul> </div> <div class="tablet:grid-col-2"> <h2 class="font-heading-md text-medium margin-top-4 tablet:margin-top-0 margin-bottom-2 tablet:margin-bottom-4"> Social </h2> <ul class="usa-list usa-list--unstyled font-sans-sm list-item-spacing-2"> <li class="display-flex flex-align-center"> <a href="https://github.com/18F" class="usa-link--external" rel="noreferrer" > <img src="/img/github-dark-2-w9jCrv94IZ.svg" class="maxw-205 margin-right-1 text-tbottom" alt="" loading="lazy" decoding="async">GitHub</a> </li> <li class="display-flex flex-align-center"> <a href="https://twitter.com/18F" class="usa-link--external" rel="noreferrer" > <img src="/img/twitter-dark-Pq04PjchNH.svg" class="maxw-205 margin-right-1 " alt="" loading="lazy" decoding="async">Twitter</a> </li> <li class="display-flex flex-align-center"> <a href="https://www.linkedin.com/company/gsa18f" class="usa-link--external" rel="noreferrer" > <img src="/img/linkedin-dark-ILbHB_Cgfp.svg" class="maxw-205 margin-right-1 " alt="" loading="lazy" decoding="async">LinkedIn</a> </li> </ul> </div> </div> </div> <div class="usa-identifier padding-top-2"> <section class="usa-identifier__section usa-identifier__section--masthead" aria-label="Agency identifier"> <div class="usa-identifier__container"> <div class="usa-identifier__logos"> <a href="https://www.gsa.gov/" class="usa-identifier__logo"> <img src="/img/gsa-logo-blue-YKGHyQURdg.svg" class="usa-identifier__logo-img" alt="gsa logo" loading="lazy" decoding="async"> </a> </div> <div class="usa-identifier__identity text-base-lightest"> <p class="usa-identifier__identity-domain">18f.gsa.gov</p> <p class="usa-identifier__identity-disclaimer text-base-lightest">An official website of the <a href="https://www.gsa.gov/about-us/organization/federal-acquisition-service/technology-transformation-services"> GSA’s Technology Transformation Services </a> </p> </div> </div> </section> <nav class="usa-identifier__section usa-identifier__section--required-links" aria-label="Important links"> <div class="usa-identifier__container"> <ul class="usa-identifier__required-links-list"> <li class="usa-identifier__required-links-item"> <a class="usa-identifier__required-link usa-link" href="https://www.gsa.gov/about" title="About GSA"> About GSA </a> </li> <li class="usa-identifier__required-links-item"> <a class="usa-identifier__required-link usa-link" href="https://www.gsa.gov/website-information/accessibility-aids" title="View accessibility statement"> Accessibility support </a> </li> <li class="usa-identifier__required-links-item"> <a class="usa-identifier__required-link usa-link" href="https://www.gsa.gov/reference/freedom-of-information-act-foia" title="Submit a Freedom of Information Act (FOIA) request"> FOIA requests </a> </li> <li class="usa-identifier__required-links-item"> <a class="usa-identifier__required-link usa-link" href="https://www.gsa.gov/reference/civil-rights-programs/the-no-fear-act" title="View No FEAR Act data"> No FEAR Act data </a> </li> <li class="usa-identifier__required-links-item"> <a class="usa-identifier__required-link usa-link" href="https://www.gsaig.gov/" title="Office of the Inspector General"> Office of the Inspector General </a> </li> <li class="usa-identifier__required-links-item"> <a class="usa-identifier__required-link usa-link" href="https://www.gsa.gov/reference/reports/budget-performance" title="View budget and performance reports"> Performance reports </a> </li> <li class="usa-identifier__required-links-item"> <a class="usa-identifier__required-link usa-link" href="https://www.gsa.gov/website-information/website-policies" title="Our privacy policy"> Privacy policy </a> </li> </ul> </div> </nav> <section class="usa-identifier__section usa-identifier__section--usagov" aria-label="U.S. government information and services"> <div class="usa-identifier__container"> <div class="usa-identifier__usagov-description text-base-lightest">Looking for U.S. government information and services?</div> <a href="https://www.usa.gov/" class="usa-link">Visit USA.gov</a> </div> </section> </div> </footer>  <script async src="/assets/js/app-IYN3AA5J.js"></script>  <script id="_fed_an_ua_tag" src="https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=GSA&subagency=TTS,18F"></script>  <script async src="https://www.googletagmanager.com/gtag/js?id=G-HBYXWFP794"></script> <script> window.dataLayer = window.dataLayer || []; function gtag() { dataLayer.push(arguments); } gtag('js', new Date()); gtag('config', 'G-HBYXWFP794', { 'anonymize_ip': true }); </script> </body> </html>

CINXE.COM

18F: Digital service delivery | Taking the ATO process from 6 months to 30 days