I'm seconding everything said here. I recently finished a project whereby it took over a year, from kickoff to handoff to deploy two blade servers. Government

I'm seconding everything said here. I recently finished a project whereby it took over a year, from kickoff to handoff to deploy two blade servers. Government IT is often extraordinarily hamstrung in the types of solutions it can deploy due to mandatory requirements to use certain security software, or employ specific policies. [1] While those policies come with a framework for adapting them to the needs of an environment, most don't understand them, and so you're often stuck with a computing environment that any DevOps engineer would find to be practically broken. There's an enormous amount of manual steps and needless shuffling between systems to accomplish the most rudimentary of tasks. This enormous inefficiency is accepted as being inevitable. Because simple tasks take so long, and making them more efficient would require enormous effort (such getting exceptions to policies approved), the issue is often solved by adding more people. Contractors make their money through staffing, so if you can show that you can get more done with more people, then it can be a good sell. Costs, however, go up. This is where your overruns come from. (Regarding ATOs, that sounds like the "Type" vs. "Site" accreditations I'm familiar with.)