That was written up in a finding also. P3. "Audit Findings  1. EAC OIT did not issue an ATO for its Microsoft Azure prior to deployment into production. " ... "NIST Special Publication (SP) 800-37, Risk Management Framework for Information Systems and Organizations A System Life Cycle Approach for Security and Privacy, Revision 2, 3.6 “Authorize” states: Authorization packages include security and privacy plans, security and privacy assessment report, plans of action and milestones, and an executive summary.  EAC OIT has implemented policies and procedures for security assessment and authorization to facilitate the implementation of information systems along with security controls in its network environment.  EAC OIT did not conduct a security assessment and authorization for some of the information systems in our sample. Specifically, the Microsoft Azure system was in operation without an ATO. Competing priorities of other activities within the OIT department have caused the delay in conducting a security assessment and authorization for its Microsoft Azure system." Edit. "EAC’s management concurred with the recommendation. EAC issued the Microsoft Azure Commercial IaaS ATO letter dated August 3, 2020. "