3 ms·

I wish I could vote more for this. You forgot that it costs at min $1M to get certified up to several dozen millions once everything is said and done; and that

I wish I could vote more for this. You forgot that it costs at min $1M to get certified up to several dozen millions once everything is said and done; and that does not guarantee any government contracts or agency purchases. You have to basically be a big player that can put up the money and because by any number of the various methods of corruption, you already know that you will have government contracts waiting for you on the far side.

dangus 1y ago
Honestly if those numbers you’re providing are accurate, that’s not a lot of money. The research I’ve done pegs the cost at $500,000 to $1.5 million. That actually is “small SaaS company” territory. And don’t forget that VCs throw more money than that around for much riskier propositions. The whole VC business is that you’ll have 1 success and 10 failures, throwing $2 million in hopes of landing a government contract (stable revenue above market rates) is probably a great investment for a lot of small/medium sized companies.
- deleted 1y ago
  [deleted]
kaydub 1y ago
You are getting ripped off. The 3paos can do FedRAMP audits for much lower. I've seen as low as $150k. We dropped our auditor for another because we were priced at $X, but when they came into our office and saw that we bring in a ton of money (we used to have our sales info on every screen on every floor of the office) they updated their pricing for next year's audit.
TranquilMarmot 1y ago
We got FedRAMP certified at a previous job. At first I balked at you saying it cost $1M but, doing some back-of-the-napkin math, that's probably pretty accurate once you take into account the salaries of everybody involved, time that we had to spend figuring out all the auditing, outside companies we had to hire and involve, and extra cloud costs and setup. Not to mention the ongoing cost of maintaining all of that and ongoing audits. We were also a pretty small startup (~50 people?) but were focused solely on government data storage and management, so it made a lot of sense for us to get the certification. It definitely paid for itself in the number of contracts it unlocked.
justincormack 1y ago
Fedramp 20x is an attempt to change this and make it much cheaper and simpler to pass, via modernization.
dragonwriter 1y ago
> You have to basically be a big player that can put up the money and because by any number of the various methods of corruption, you already know that you will have government contracts waiting for you on the far side. You seem to working from the faulty premise that FedRAMP only isna concern for durect federal contracting. Because FedRAMP applies to systems with federal data, and because entities other than the federal government often have a mix of federal and non-federal data, it is quite common for a vendor who does not have FedRAMP certification (either at all or for some services) to know by non-corrupt means that some of their customers have workloads that are in-house or with a different vendor due to FedRAMP that they would bring to the first vendor if that vendor was FedRAMP compliant for the services involved.

dangus 1y ago

Honestly if those numbers you’re providing are accurate, that’s not a lot of money. The research I’ve done pegs the cost at $500,000 to $1.5 million. That actually is “small SaaS company” territory. And don’t forget that VCs throw more money than that around for much riskier propositions. The whole VC business is that you’ll have 1 success and 10 failures, throwing $2 million in hopes of landing a government contract (stable revenue above market rates) is probably a great investment for a lot of small/medium sized companies.

deleted 1y ago
[deleted]

kaydub 1y ago

You are getting ripped off. The 3paos can do FedRAMP audits for much lower. I've seen as low as $150k. We dropped our auditor for another because we were priced at $X, but when they came into our office and saw that we bring in a ton of money (we used to have our sales info on every screen on every floor of the office) they updated their pricing for next year's audit.

TranquilMarmot 1y ago

We got FedRAMP certified at a previous job. At first I balked at you saying it cost $1M but, doing some back-of-the-napkin math, that's probably pretty accurate once you take into account the salaries of everybody involved, time that we had to spend figuring out all the auditing, outside companies we had to hire and involve, and extra cloud costs and setup. Not to mention the ongoing cost of maintaining all of that and ongoing audits. We were also a pretty small startup (~50 people?) but were focused solely on government data storage and management, so it made a lot of sense for us to get the certification. It definitely paid for itself in the number of contracts it unlocked.

justincormack 1y ago

Fedramp 20x is an attempt to change this and make it much cheaper and simpler to pass, via modernization.

dragonwriter 1y ago

> You have to basically be a big player that can put up the money and because by any number of the various methods of corruption, you already know that you will have government contracts waiting for you on the far side. You seem to working from the faulty premise that FedRAMP only isna concern for durect federal contracting. Because FedRAMP applies to systems with federal data, and because entities other than the federal government often have a mix of federal and non-federal data, it is quite common for a vendor who does not have FedRAMP certification (either at all or for some services) to know by non-corrupt means that some of their customers have workloads that are in-house or with a different vendor due to FedRAMP that they would bring to the first vendor if that vendor was FedRAMP compliant for the services involved.