Authority to Operate in weeks, not years

Almost never the assessment itself. The time goes into producing a body of evidence that is internally consistent — a system security plan that describes the system as built, control implementation statements that match what an assessor will see, and a boundary that everyone agrees on. Programmes that miss dates are usually not failing controls; they are discovering during assessment that the documentation describes a system that has since changed, and rewriting it while the assessor waits.

No. Authorization is a risk decision made by a named authorizing official who accepts residual risk on behalf of the organisation. That is why two systems with identical control posture can receive different decisions, and why a high percentage of implemented controls does not guarantee an outcome. What moves an AO is a clear statement of what the residual risk is, what compensates for it, and what happens if it is realised — which is a different artifact from a control checklist.

They differ in what they permit and for how long. A full authorization permits operation for the stated term. An authorization with conditions permits operation while specified deficiencies are remediated on an agreed schedule, which means the POA&M is load-bearing rather than administrative. An interim authorization to test permits a system to operate in a live environment for testing purposes only, and is not a route to production — using one as though it were is a recurring finding.

It gets skipped because it produces no artifact an assessor demands, and it costs the programme at the end. Prepare is where the boundary, the common controls available for inheritance, the roles and the risk tolerance are settled. A programme that starts at Categorize has deferred those decisions, not avoided them — they resurface during assessment as boundary disputes and as controls nobody has inherited, at the point in the schedule where they are most expensive to resolve.

It can, and that is where most of the available time saving actually sits, but only if the evidence was captured against a control and a system component rather than assembled for a specific assessment. Evidence gathered as a package for one assessor is difficult to reuse because nothing records what it was proving. Evidence bound to the control it satisfies and the asset it came from can be re-presented against a different framework, which is the same mechanism that makes reciprocity work.