Exhibit_H_-_ATO_Letter.doc

[Document classification not provided]

DHS Sample System [project ID not provided] Authorization to Operate

(ATO)

Prepared for Department of Homeland Security Headquarters (DHS HQ) 123 Sample System Dr.

Washington, DC 00000 [project version not provided] 17 March 2015 From:

[Authorizing Official's name not provided]

Authorizing Official Thru:

[Chief Information Security Officer's name not provided] [Chief Information Security Officer's component not provided] Chief Information Security Officer [Information System Security Manager's name not provided] Information System Security Manager To:

[Information System Owner's name not provided]

Information System Owner Subject: Security Accreditation Decision for DHS Sample System I have reviewed the results of the security assessment of the DHS Sample System, its constituent system elements (if applicable) located at Not Specified and the supporting evidence provided in the associated security authorization package. The authorization package includes the current Security Plan (SP), the Security Assessment Report (SAR), and the Plan of Action and Milestones (POA&Ms). After evaluating the results of the security assessment, it is my opinion as the Authorizing Official (AO) that an acceptable level of risk to the Department of Homeland Security Headquarters (DHS HQ) exists and that the DHS Sample System should be authorized to operate.

I authorize full deployment and production operations for the DHS Sample System, for processing Sensitive Information. An Authorization to Operate (ATO) is granted, valid from [ATO authorization date not specified] to [ATO authorization termination date not specified], or sooner if significant changes are made to the system engineering design and architecture. This security authorization is my formal declaration that adequate security controls have been implemented in the information system and that a satisfactory level of security is present in the system.

The security authorization of the information system will remain in effect as long as:

1. The security status reporting for the system is maintained in IACS.

2. The vulnerabilities reported during the continuous monitoring process do not result in additional agency-level risk which is deemed unacceptable.

3. The system has not exceeded the maximum allowable time period between security authorizations in accordance with federal or agency policy.

A copy of this letter with all supporting documentation should be retained in Information Assurance Compliance System.

Signature(s) [Document classification not provided]