What's the difference between ATO and CMMC?

ATO (Authorization to Operate · program-office citation) and CMMC (Cybersecurity Maturity Model · L1 · L2 · L3) are distinct cite-anchors. Planisphere's evidence record maps both controls for evaluator review; sufficiency remains evaluator-specific.

Do I need both ATO and CMMC in my record?

If both apply to your tool deployment, yes — and the record maps both controls in one artifact at no extra cost.

Comparison · register 09

ATO vs CMMC.

Two regulatory anchors. Planisphere's evidence record maps both controls. This page is the comparison query's canonical destination.

Scope an AI workflow review ATO brief CMMC brief

01 ·

When to lead with ATO.

Use ATO as the primary anchor when the evaluator is shaped this way.

Audience. Authorization to Operate · program-office citation.

Shape. folder · brass authorization check.

Where it lives in the record. The ATO cite-anchor pins next to every artifact in ATTESTATION.json. See the ATO brief for the field-level mapping.

02 ·

When to lead with CMMC.

Use CMMC as the primary anchor when the evaluator is shaped this way.

Audience. Cybersecurity Maturity Model · L1 · L2 · L3.

Shape. 3 chevrons stacked · brass top L3.

Where it lives in the record. The CMMC cite-anchor pins next to every artifact in ATTESTATION.json. See the CMMC brief for the field-level mapping.

03 ·

Both at once.

The evidence record maps both anchors for review — you don't have to pick.

Planisphere's evidence record is multi-control by construction. ATO and CMMC are both keys in the record's requirement list; the same SHA-pinned, Merkle-rooted artifact gives both evaluators a shared review record.

The requirement list is open — add any standard the regulator names. See the full compliance-control register.

Compare AI options for compliance