My startup company is planning to apply to a state RFP expected to be put out sometime in the coming year. We just learned that one of the requirements they listed in the RFI was that the platform must be FedRAMP and SOC type 2 certified. I've been doing a decent amount of research since that discovery and am looking for some validation if I'm barking up the right tree for my understanding as well as maybe some insight as to how this works exactly.

First off, my initial research yielded that getting a FedRAMP certification can cost between $150k to $2 million with the average being $1 million. Right off the bat those numbers would make it prohibitive for a startup to break into state level contracting (for this specific case at least).

My further digging yielded that there are cloud hosting platforms that are themselves FedRAMP certified - AWS seems to be the big one. Yes, I understand that there are 2 levels to AWS FedRAMP, one not being open to anyone to use. It is also my understanding that simply using AWS and services covered under their FedRAMP certification does not mean that we automatically have an ATO. Make sense I guess, so this puts us back in a predicament as there's no way we can afford FedRAMP without a client.

What I've been reading, however, is it's uncommon to even go through FedRAMP certification without a government agency to sponsor you through the process. My understanding for that is if our proposal/platform were selected, the state agency would sponsor us to go through the certification process. This would make way more sense especially considering the platform they are going to be requesting proposals for doesn't entirely exists currently with the features they want - so it would be hard to see even a larger company having a platform ready with the certification. Furthermore, it would make no sense for even a larger company to drop that kind of money on certification only on a what if that their proposal is selected.

I am curious for anyone with experience in a similar situation if the certification costs are still as high as before mentioned with a sponsoring agency. Regardless of the price, with my current understanding, part of the cost for our platform that we put in our proposal would have to include certification costs.

I'd like to add that I understand that what exactly the required FedRAMP certification requires varies between use cases. They have not release this exact information which again leads me to believe they are not expecting someone to already have the certification.