clarify that ATOs apply to software that's built *and* software that's bought

[afeld]

...though an agency may have distinct processes for each.

cc #7

[trevorbryant]

I don't know if this is true for many agencies. Software that's bought (COTS) are reviewed by the Change Control Board and stakeholders to review to proceed to becoming on the agency's software list for approved use.

After then, that engineering task for implementation becomes part of the new A&A process to get authorized for the system to go live.