Hi friends,

I'm a founder of a fresh organization that provides some really innovative SaaS for government operations.

In this case, we are trying to nail a State RFP that requires the solution is FedRAMP certified. On the timeline they would like, this will be extremely difficult, and I want to present the best possible case in our RFP: to my understanding, that would be FedRAMP Ready.

The solution will (99.9% likely) handle and manage PII, so the end-state is probably FedRAMP Moderate or FedRAMP High depending on the procuring agency's desires. I am already pursuing StateRAMP which helps add a note of credibility at a much lower cost. To compete with other vendors on this RFP, I want to get as close to full FedRAMP as possible, but the RFP timeline is going to make that all but impossible. So, again, FedRAMP Ready is probably as close as we can get.

For clarity, it will be made of FedRAMP parts: AWS GovCloud using only FedRAMP M & H services which have already been JAB P-ATO designated. Container images that are built to be FedRAMP. I think this goes a long way to reduce the costs and complexity, but it doesn't really do much for our own Cloud Service Offering, which makes sense from a security standpoint: just because you use those tools doesn't mean your solution doesn't violate some important security controls in your application. If our application uses a logging tool that compromises a security boundary, now the whole environment is not FedRAMP compliant, because arbitrary data could leak.

So, I'm left with FedRAMP Ready as the best option. It's expensive, but maybe it's the only way to satisfy requirements on the RFP.

Am I thinking about this in the right way? Does anyone have experience with this (State-level procurement requiring FedRAMP)? Any vendor or 3PAO suggestions or smart ways to pursue FedRAMP Ready on an accelerated timeline? Cost estimations (I've seen a few but they vary pretty wildly)?

Any knowledge or experience you can impart would be extremely helpful.