These diagrams show the NCI A&A process to complete the normal* FISMA ATO process.
The first diagram is for NCI internal systems in CBIIT fully-managed hosting:
NCI A&A Workflow Diagram for Internal Systems
The second diagram is for 3rd party/contractor hosted external systems as well as systems in CBIIT customer-managed or co-located (Colo) hosting:
NCI A&A Workflow Diagram for 3rd Party/Contractor-Hosted, Customer-Managed, and Colo Systems
*This excludes the streamlined ATO process, also known as ATO as a Service (ATOaaS) and the low-impact software as a service (LI-SaaS) approval processes.