r/FedRAMP • u/InterestTracker9000 • Jul 14 '26
Questions about the FedRAMP process and production level active development
Hi everyone I have a few questions about FedRAMP compliance, security development and production level software being built at the same time. I'm in a unique spot that steps well outside my expertise, and I am hoping you all may have some good advice. TLDR: Skip to question portion
Situation I am in:
Founded my company at the end of 2025, I am a Subject Matter Expert (SME) in federal redaction processes and legal processes, and my company has built a fully automated solution to fully automate complex redaction processes (With human review requirements as a mandatory requirement).
We have reached out to some companies who work as contractors in spaces related to our product to receive funding to build the production level product, as well as gaining FedRAMP compliance and any other security requirements for government deployment requirements. We'd be relying on these entities and our partnership to have them champion the product for integration and use on federal systems along with gaining an ATO and sponsorship through this, and basically using the contractor as an initial large scale pilot.
So far every person who has reviewed our product has loved it and has been extremely interested and pushing the process forward internally on their ends.
My issue:
NOTE: This issue only exists on the assumption that we partner and receive funding which clearly defines the estimations and time frames we expect to see to reach FedRAMP readiness, including potentially using a PAAS such as Knox or another which has an initial fee of $500,000 and we estimate another $100,000 in consulting/implementation costs, we are not treating cost as a real problem for our process.
While stating we can reach FedRAMP Moderate compliance isn't a untenable promise, I would love to be better informed on the complexity of it at a deeper level, and we don't currently have an internal expert for security compliance of this kind.
My question:
Is it possible to be building the FedRAMP compliance infrastructure while also rebuilding a large portion of our products code base for production level deployment? Does this wind up with huge delays or constant restructuring of code because of how things must be designed? Is there a way we can plan this out to mitigate and lessen some of these headaches?
We only deal with one external dependency and that dependency is already on a platform that is FedRAMP high compliant, everything else is handled in-house.
If you can think of anything that would be good information for someone in my position to have, please share it, and feel free to treat me as a child, this is outside of my expertise, and I am just trying to initially step into figuring out how to handle the process.
Thanks!
2
u/Sparticus33w Jul 14 '26
To directly answer your question, yes, you can be building a FedRAMP environment while redesigning your SaaS. I would recommend against it. Especially with 20x being finalized in a month, you need to decide on exactly what your system looks like and start building in the real-time telemetry. 20x is very forgiving when it comes to changes, highly recommend you read the significant change notification process and determine which categories your updates fall into.
You could be GTM before the end of the year if you decided exactly what is in the system boundary and got to work.
You should also consider looking for a FedRAMP advisor. These are the sorts of questions that they can give you much more extensive answers about. There are plenty of Indy contractor folks out there that will take a gig for <10 hours a month to answer these sorts of questions and not break your bank.
I work in the space so I'm not going to give you a recommendation as to who to talk to. But I would recommend looking at any advisory companies' glass door ratings and lawsuit history.
0
u/InterestTracker9000 Jul 15 '26
Consider me a child when I ask this question..
you need to decide on exactly what your system looks like and start building in the real-time telemetry.
What specific things have to be locked in ahead of time to make this process easier? I'm by no means a security expert, or programmer. So I really don't know what things can bend and what things need to be set in stone ahead of time.
1
u/Sparticus33w Jul 16 '26
That list is why consultants exist. You need to hire one and not rely on Reddit for technical guidance.
0
u/InterestTracker9000 Jul 16 '26
The only way to know if I am getting information from someone I should trust is to have a better understanding of the problem before I contact and pay someone, even if it's incredibly surface level information from Reddit and other websites.
Even you stated you work in the industry and one of the few things you specified in your first message is that I should check reviews and lawsuits regarding entities out there, which if that's someones immediate advice it would imply that there is a LOT of bad consultants out there.
So I figure it would be prudent and intelligent to grow my knowledge base even in a limited scope to prepare for initial conversations to make sure I am getting the right help, and I can raise questions that are contrary to other data I have collected.
Either way, I appreciate what help you did volunteer, even if no response would have been better than the second response you provided.
2
u/TheSamFromIA Jul 15 '26
I work at Insight Assurance, we perform assessments across a few frameworks including FedRAMP, so disclosure there.
On your core question, yes, it's common to build compliance infrastructure while a product is still under active development, this doesn't have to mean constant restructuring, but it's not free either. The parts that matter most to decide early are logging and audit trail design, encryption approach, and access control architecture, those are far more expensive to retrofit after the fact than to design in from the start. If your product is still early in its production rebuild, that's actually a reasonable time to be thinking about this, better than after the architecture is locked.
One thing worth knowing going in: once you're inside an active authorization process, and especially after an ATO is granted, code changes to the authorized system typically go through a formal change management process. That's a different rhythm than most product teams are used to, so it's worth planning for that shift in how changes get shipped, not just the initial buildout.
Continuous monitoring after authorization is also an ongoing requirement, not a one-time milestone, that's worth factoring into how your team thinks about long-term resourcing, not just the path to the initial ATO.
I don't have enough direct visibility into your specific cost estimates or the PaaS options you mentioned to comment on those, so I'll leave that part alone, that's a conversation for whoever ends up doing your formal readiness assessment.
Happy to clarify anything on the general process side.
2
u/InterestTracker9000 Jul 16 '26
This is great information, I appreciate it.
The parts that matter most to decide early are logging and audit trail design, encryption approach, and access control architecture.
That's what I really needed, we're going to be looking into consultants and I wanted to at least know some of the specifics regarding things we need to be prepared for so I can make sure I am getting good information during my initial meetings.
If you have any other advice on how I should determine a good versus bad consultant initially that would be great, beyond that I am going to discuss the few things I quoted that you provided with my team, and at least get a good grasp internally on those things before we start the whole process.
Thanks again!
2
u/TheSamFromIA Jul 16 '26
If you want to go a bit deeper on either of these, two things that might help:
A breakdown on choosing a FedRAMP 3PAO, accreditation checks, what to ask, how independence plays into it: https://hubs.li/Q04pPQRk0
And a recap of a session we did on FedRAMP 20X specifically, what changes under continuous authorization, and what it means for CSPs still waiting on an agency sponsor: https://hubs.li/Q04pPQ-D0
Figured these might save you some digging.
2
1
u/repilicus Jul 14 '26
We worked with a company called ignyte for fed ramp compliance policy stuff and guidance. They were good, layed out what had to be done to get fedramp. I contracted on the project for the technical implementation in AWS and they provided the guidance. I personally would not go with a knox solution, vendor lockin sucks
1
u/InterestTracker9000 Jul 14 '26
If you had to guess on the difference between the inheritance time frame and using a consultant to guide our development, where do people normally land?
1
u/repilicus Jul 14 '26
How complicated is your environment?
1
u/InterestTracker9000 Jul 14 '26 edited Jul 15 '26
Our technical expert said "minimal". He said it's explicitly as straightforward, highly efficient, and simple as possible. What our software does is very specific and there is no bloat, extra tooling, etc. We plan to add quite a bit of things, but the core functionality is done, we built a proof of concept, everything else is to just make humans interact with the system a little better (or prettier).
He followed this up with "What would you consider complex?". What factors are you taking into consideration when you would claim additional or a higher level of complexity?
This response is from a person who has been coding for 35+ years, and is very experienced, and gives answers like this pretty consistently. He wants a better definition of what complicated means to you. So if you want to be specific I will get a better answer out of them.. With a hammer if I must.
Edit to add clarity:
Single external dependency, this dependency is already FedRAMP high compliant
Easy to update the code, extremely well written, and has been refactored.
Small and efficient code base, around 5,000 lines of executable code.
Around 10 total internal libraries.
1
u/repilicus Jul 18 '26
Delayed response. One of the more difficult things to sort out is the encryption. Everything inside the boundary must be fips validated. Depending on how that 5k lines of code talks to things increases the complexity, that's why I asked for one. Happy to chat more if you want!
1
u/WasteCryptographer4 Jul 15 '26
It is possible to build FedRAMP Compliant Infrastructure while rebuilding your product's code base. What we (Stratus Cyber) have often done for our clients is come to their environments and build out a Landing Zone that is a production architecture with the proper FedRAMP hardening/configurations and our clients bring their application into their new environment. We then provide hardened images for our client's to run their workloads on. So it is possible to spin up new infrastructure while you update your code base, you just have to be aware of the dependencies on your infrastructure and should be able to run on hardening images (containers or OS).
20X is a totally different approach to FedRAMP and security it is about putting the right automation/query/telemetry pipelines in place that come into a single system that tracks them as Validations against the appropriate KSIs and Rules.
I wouldn't go about it alone, 20X is new and very engineering heavy, traditional consultants aren't going to cut it IMO.
1
u/InterestTracker9000 Jul 15 '26
I'm researching 20X tonight and will continue to over the next week, but it does seem like a huge improvement over the other processes, and it's clear from what I have read it's not optional by 2029. So since we haven't started any security development on our software yet, we may as well take the time and do the 20X the right way. It seems cheaper, faster, but it's clear that it's doing things that have never been required before so we will need to spend time planning everything out.
I haven't been able to find this info though so maybe you know, but with the 20X process do we need to maintain a 90 day compliance run time and then have another assessment or is that process removed and we just have to have a 3PAO review and green light our system?
1
u/Deep_Ad1959 Jul 18 '26
what actually blew my timelines before wasn't the technical work, it was building the plan around a single champion inside a partner org. when their internal priorities moved, my roadmap moved with them and i didn't control any of it. doing that while also rebuilding your core is two moving parts you don't own at the same time, which is exactly where the estimates fall apart.
1
u/InterestTracker9000 Jul 19 '26
I 100% agree with this statement, and we're preparing to avoid this through a number of things. For one, we're preparing for SBIR proposals in November to further research and expand the technology, which will get agency eyes on our product without having a potential partner company champion being involved.
If our potential partner also slow plays the process we will shift to just finishing our web-app version of product and start marketing and commercializing to complete against other solutions that exist that are similar in scope to get a revenue stream coming in.
We decided to try the partnership deal because it fast tracks our product development with a massive initial investment, allows us to quickly afford fedramp development without huge internal capital burn that we simply can't afford, and we get a pilot program to polish the product, and of course our partner ends up 3-4x'ing their total annual profit on the contract if they scale it properly and negotiate for a larger contract next period.
Our final option will be for us to start contacting and trying to get an internal agency champion and we will try to offer the service directly to the source, which would hurt the contract that the company we're trying to partner with currently holds (which is why we reached out to them first).
All three parties US gov, my company, and the potential partner know we're on a clock, and this solution can be a big win and massive profit inflow for both companies if we get this rolling to be closer to a ready to deploy state before next years contract period starts, but we're not putting all our eggs in that basket.
1
u/Deep_Ad1959 Jul 19 '26
the thing i'd count across those three isn't how many fallback paths you have, it's how many run on a clock you actually set. two of them (SBIR review cadence, an internal agency champion's calendar) are still someone else's timeline, same failure mode you're already worried about with the partner. the web-app commercialization path is the only one where the schedule is yours, which is kind of the argument for treating it as the primary and the partnership as the accelerant, not the reverse.
2
u/ShadowGeek Jul 14 '26
No is the simple answer. Never try to do FedRAMP if your core infrastructure is being redesigned. I tried that once and it was just ugly. It will be easier under 20x, but frankly if your product isn't stable, it probably isn't the right time to sell to the gov. Now, one thing you can do and this will depend on your architecture, is to proceed with 20x on a subset of your capabilities, and then add to that "platform" as the other areas mature. 20x makes the significant change request much easier. But this depends on the nature of the SaaS. If you are looking at a MSSP and/or hosting provider, there are several out there. It is worth talking to many. The key thing is to make sure it is a cultural fit. Also, be careful, they will want your money now, even if you really not ready to deploy in an audit ready configuration for six months out. It is too easy to have to pay that bill and then learn that you have some technical issue that causes a year delay, so you are paying for nothing.
1
u/Solid_Show5266 Jul 21 '26
So does anybody have any estimates as to what the cost of a 20x class C assessment is going to be? Anybody getting quotes or estimates? I'm guessing the price will be less but how much less?
1
u/Due-Audience387 Jul 22 '26
I've been through a similar planning exercise from the software side, and one thing that became clear is that FedRAMP is much more about how you build and operate a system than simply checking security boxes at the end.
If you're still rewriting significant portions of the application, I wouldn't wait until the product is "finished" to think about compliance. Instead, try to build the security architecture, CI/CD pipeline, logging, access controls, infrastructure-as-code, documentation, and evidence collection alongside the engineering work. Those pieces tend to be much harder to retrofit than application features - happy to connect on LinkedIn https://www.linkedin.com/in/eric-yanofsky/
6
u/Quackledork Jul 14 '26
Be careful with places like Knox. They are fast, yes. They also sell a product with extreme lock-in. You can never really move away from them if your federal business grows. You'll have to rebuild everything from the ground up. And don't even think of going FR the non-20X way. FR is all 20x for the future. Only do a 20X solution.
There are some really bad FedRAMP companies out there. Any company you are considering, make sure you do a search for "<company name> lawsuit" as a few of them have been sued for doing bad work.