diff --git a/atst/routes/task_orders/new.py b/atst/routes/task_orders/new.py
index 1f1277fc..555b494f 100644
--- a/atst/routes/task_orders/new.py
+++ b/atst/routes/task_orders/new.py
@@ -8,25 +8,32 @@ from atst.models.permissions import Permissions
 from atst.utils.flash import formatted_flash as flash
 
 
-@task_orders_bp.route("/portfolios/<portfolio_id>/task_orders/new")
-@task_orders_bp.route("/portfolios/<portfolio_id>/task_orders/<task_order_id>/edit")
-@user_can(Permissions.CREATE_TASK_ORDER, message="view new task order form")
-def edit(portfolio_id, task_order_id=None):
-    form = None
+def render_task_orders_edit(portfolio_id, task_order_id=None):
+    render_args = {}
 
     if task_order_id:
         task_order = TaskOrders.get(task_order_id)
-        form = TaskOrderForm(number=task_order.number)
+        render_args["form"] = TaskOrderForm(
+            number=task_order.number, pdf=task_order.pdf
+        )
+        render_args["task_order_id"] = task_order_id
     else:
-        form = TaskOrderForm()
+        render_args["form"] = TaskOrderForm()
 
-    cancel_url = (
+    render_args["cancel_url"] = (
         http_request.referrer
         if http_request.referrer
         else url_for("task_orders.portfolio_funding", portfolio_id=portfolio_id)
     )
 
-    return render_template("task_orders/edit.html", form=form, cancel_url=cancel_url)
+    return render_template("task_orders/edit.html", **render_args)
+
+
+@task_orders_bp.route("/portfolios/<portfolio_id>/task_orders/new")
+@task_orders_bp.route("/portfolios/<portfolio_id>/task_orders/<task_order_id>/edit")
+@user_can(Permissions.CREATE_TASK_ORDER, message="view new task order form")
+def edit(portfolio_id, task_order_id=None):
+    return render_task_orders_edit(portfolio_id, task_order_id)
 
 
 @task_orders_bp.route("/portfolios/<portfolio_id>/task_orders/new", methods=["POST"])
@@ -35,7 +42,8 @@ def edit(portfolio_id, task_order_id=None):
 )
 @user_can(Permissions.CREATE_TASK_ORDER, message="create new task order")
 def update(portfolio_id, task_order_id=None):
-    form_data = http_request.form
+    form_data = {**http_request.form, **http_request.files}
+
     form = TaskOrderForm(form_data)
 
     if form.validate():
@@ -56,4 +64,4 @@ def update(portfolio_id, task_order_id=None):
         )
     else:
         flash("form_errors")
-        return render_template("task_orders/edit.html", form=form)
+        return render_task_orders_edit(portfolio_id, task_order_id), 400
diff --git a/templates/task_orders/edit.html b/templates/task_orders/edit.html
index fb3f1c6c..abd560d7 100644
--- a/templates/task_orders/edit.html
+++ b/templates/task_orders/edit.html
@@ -12,7 +12,12 @@
         {% include "portfolios/header.html" %}
       {% endblock %}
       <base-form inline-template>
-        <form id="new-task-order" action='{{ url_for("task_orders.update", portfolio_id=portfolio.id) }}' method="POST" autocomplete="off" enctype="multipart/form-data">
+        {% if task_order_id %}
+          {% set action = url_for("task_orders.update", portfolio_id=portfolio.id, task_order_id=task_order_id) %}
+        {% else %}
+          {% set action = url_for("task_orders.update", portfolio_id=portfolio.id) %}
+        {% endif %}
+        <form id="new-task-order" action='{{ action }}' method="POST" autocomplete="off" enctype="multipart/form-data">
           {{ form.csrf_token }}
           <div class="panel__content">
             <!-- TODO: implement save bar with component -->
diff --git a/tests/routes/task_orders/test_new.py b/tests/routes/task_orders/test_new.py
index 17904355..f4ee00d4 100644
--- a/tests/routes/task_orders/test_new.py
+++ b/tests/routes/task_orders/test_new.py
@@ -3,7 +3,7 @@ from flask import url_for
 
 from atst.domain.permission_sets import PermissionSets
 from atst.domain.task_orders import TaskOrders
-from atst.models.attachment import Attachment
+from atst.models import Attachment, TaskOrder
 from atst.utils.localization import translate
 
 from tests.factories import (
@@ -39,13 +39,15 @@ def test_task_orders_new(client, user_session, portfolio):
     assert response.status_code == 200
 
 
-def test_task_orders_create(client, user_session, portfolio):
+def test_task_orders_create(client, user_session, portfolio, pdf_upload, session):
     user_session(portfolio.owner)
+    data = {"number": "0123456789", "pdf": pdf_upload}
     response = client.post(
-        url_for("task_orders.update", portfolio_id=portfolio.id),
-        data={"number": "0123456789"},
+        url_for("task_orders.update", portfolio_id=portfolio.id), data=data
     )
     assert response.status_code == 302
+    task_order = session.query(TaskOrder).filter_by(number=data["number"]).one()
+    assert task_order.pdf.filename == pdf_upload.filename
 
 
 def test_task_orders_create_invalid_data(client, user_session, portfolio):
@@ -54,17 +56,53 @@ def test_task_orders_create_invalid_data(client, user_session, portfolio):
     response = client.post(
         url_for("task_orders.update", portfolio_id=portfolio.id), data={"number": ""}
     )
-    assert response.status_code == 200
+    assert response.status_code == 400
     assert num_task_orders == len(portfolio.task_orders)
     assert "There were some errors" in response.data.decode()
 
 
-def test_task_orders_edit():
-    pass
+def test_task_orders_update(client, user_session, portfolio, pdf_upload):
+    user_session(portfolio.owner)
+    data = {"number": "0123456789", "pdf": pdf_upload}
+    task_order = TaskOrderFactory.create(number="0987654321")
+    response = client.post(
+        url_for(
+            "task_orders.update", portfolio_id=portfolio.id, task_order_id=task_order.id
+        ),
+        data=data,
+    )
+    assert response.status_code == 302
+    assert task_order.number == data["number"]
 
 
-def test_task_orders_update():
-    pass
+def test_task_orders_update_pdf(
+    client, user_session, portfolio, pdf_upload, pdf_upload2
+):
+    user_session(portfolio.owner)
+    task_order = TaskOrderFactory.create(pdf=pdf_upload)
+    data = {"number": "0123456789", "pdf": pdf_upload2}
+    response = client.post(
+        url_for(
+            "task_orders.update", portfolio_id=portfolio.id, task_order_id=task_order.id
+        ),
+        data=data,
+    )
+    assert response.status_code == 302
+    assert task_order.pdf.filename == pdf_upload2.filename
+
+
+def test_task_orders_update_delete_pdf(client, user_session, portfolio, pdf_upload):
+    user_session(portfolio.owner)
+    task_order = TaskOrderFactory.create(pdf=pdf_upload)
+    data = {"number": "0123456789", "pdf": None}
+    response = client.post(
+        url_for(
+            "task_orders.update", portfolio_id=portfolio.id, task_order_id=task_order.id
+        ),
+        data=data,
+    )
+    assert response.status_code == 302
+    assert task_order.pdf is None
 
 
 @pytest.mark.skip(reason="Update after implementing new TO form")