How do you move a system through the Risk Management Framework (RMF) and Authorization to Operate (ATO) process?