The Trial Run

This is a work of fiction. The agency, the vendors, and everyone in it are made up. I wrote it to show how FedRAMP 20x can work in practice: an agency trying cloud services before it commits to one, and an authorization built on the evidence providers publish. The steps behind the story are mapped out in the author’s note at the end.

1. The Dread

Priya Raman had a spreadsheet with forty-one GRC vendors on it, and she hated every row.

“Forty-one,” she said, turning her laptop toward Marcus Webb. “Every one of them says they’ll automate our controls. Every one of them wants a demo, a pilot, and a three-year contract.”

Marcus, the agency’s ISSO, didn’t look up from his own screen, where a familiar calendar was open. “You know what happened the last time we brought in a new tool? Fourteen months. Fourteen months from ‘we like the demo’ to an ATO. By the time it went live, the requirements had changed.”

“And this time we’re the ones picking the vendor. If we pick wrong, the Department is stuck with a system that doesn’t fit, and it’s my name on the memo.”

“It’s my name on the authorization package,” Marcus said. “Same problem, different signature line.”

They sat in the small conference room on the fourth floor, the one with the broken thermostat. Priya was the product owner for the Department’s new governance, risk, and compliance platform, the tool that would finally replace the tangle of spreadsheets, shared drives, and email chains the security office used to track controls. Marcus was the person who would have to certify it was safe to run. Neither of them had slept well since the kickoff.

Behind them, on the whiteboard, Priya had written 14 MONTHS?! in red marker on the day of the kickoff. Nobody had erased it.

“Here’s what I keep coming back to,” Priya said. “Before we can even try a tool with real workflows, we need a security assessment. Before we can get an assessment, we need to pick a tool. So we pick blind, wait a year, and find out if we were right.”

Marcus finally closed the calendar. “Then let’s talk to someone who has seen this go better.”

2. The Liaison

Tomás Okafor, the Department’s FedRAMP liaison, listened to the whole story without interrupting. Then he pulled a chair around and opened the FedRAMP Marketplace on the wall display.

“You’re describing the old world,” he said. “Pick first, assess later, pray in between. FedRAMP 20x changes the order of operations.”

“Meaning what?” Marcus asked.

“Meaning the provider does the heavy lifting up front, and publishes the evidence where you can read it. Filter for 20x, Class A.” He clicked. A short list appeared. “Class A is the entry point. The provider has to bring a recent, independent assessment, a SOC 2 Type II, a FedRAMP Rev5 assessment, or GovRAMP, from the last twelve months. On top of that they show FedRAMP a fresh certification package, address a required set of Key Security Indicators, and publish it all in machine-readable form on a trust center. FedRAMP reviews it and lists them here.”

Priya leaned forward. “So these vendors are already vetted?”

“Certified, not authorized.” Tomás tapped the table. “FedRAMP certification says the provider meets FedRAMP’s requirements for that class. It does not say your agency has accepted the risk of using it. That’s still an Authorization to Operate, and it’s still Dr. Ruiz’s signature. But you get to start from the provider’s evidence instead of a blank page.”

“And the trials?” Priya asked. “You mentioned trials.”

“That’s the good part. Class A is meant for lower-risk use. You don’t have to commit to a vendor to learn about it. Take three or four Class A providers, put them in a sandbox with synthetic or non-sensitive data, and let your team actually use them for a few weeks. No agency data of consequence, no production connections, no procurement lock-in. You’ll learn more about fit in a month than a year of demos would teach you.”

Marcus was already writing. “And the security side of a trial like that?”

“Small and cheap. You document the boundary and the data, you read the trust center package, you agree on rules of engagement. Then, when you pick a winner, the evidence you gathered during the trial becomes the seed of your ATO package.”

Priya looked at Marcus. Marcus looked at Priya. For the first time in weeks, neither of them looked tired.

“That’s it?” Priya said. “We just… try them?”

“Carefully,” Tomás said, smiling. “But yes.”

3. The Categorization

Marcus started where the Risk Management Framework starts: with what the system would touch.

He and Priya spent an afternoon on the categorization worksheet, and it was the shortest afternoon of the project. What would a trial sandbox hold? Synthetic control descriptions, invented evidence, a fictional system. No federal data, no personal data, no real assessment results. In the language of FIPS 199 they rated confidentiality, integrity, and availability each LOW, with a sentence of reasoning apiece. Then they wrote the boundary: who would log in, what would flow in, and what would not.

At the bottom Marcus added a note: Real data changes this worksheet. If we ever load real assessment results, we redo it.

“For the trials, nothing real goes in,” Marcus said. “If a vendor’s sandbox gets popped, the worst outcome is an embarrassing test dataset. That makes it a LOW system, which means a LOW-level ATO. It’s the whole reason we can try several at once.”

Tomás helped them pick four Class A providers from the Marketplace based on features. “A year ago,” said Tomás, “we might only have a few choices. Mostly larger companies with larger price tags. FedRAMP 20x has opened the marketplace to more competition, including lots of small businesses with innovative products.” For each product offering, Marcus opened the trust center and pulled the certification data: the current status of the Key Security Indicators, the assessment summary, the incident history, the list of agencies already using the service. It was all structured. He could script against it.

“I wrote a little Python thing,” he admitted to Priya. “It pulls each vendor’s JSON and diffs the indicators. Took an hour. Last time this would’ve been four hundred pages of PDFs and would have taken me days to go through even one package, let alone four!”

Then came the part that made Priya laugh out loud: Marcus was going to authorize all four.

“Four ATOs?” she said. “I thought one ATO was the whole nightmare.”

“One Moderate ATO with real data is a nightmare,” Marcus said. “Four LOW ATOs on synthetic data, for services that are already FedRAMP certified and publishing current evidence, are four short packages.” He had built a template: the system description, the FIPS 199 worksheet, the implemented-control notes pulled from each vendor’s trust center, the agency’s few responsibilities (single sign-on, a named owner, a synthetic-data-only rule with no exceptions), and a one-page risk statement. The first package took him about a day. He finished the other three before lunch the next day.

4. The Four Signatures

Dr. Elena Ruiz, the Department’s Authorizing Official, had a reputation. She read everything, she asked the question you had hoped she wouldn’t, and she had once sent back a package because a diagram didn’t match its own legend.

She had been told to expect a single Moderate authorization decision for the new GRC platform: a thick package, a long review. On a Monday, Priya, Marcus, and Tomás put four thin ones on her desk.

“Four,” she said.

“Four LOW,” Marcus said. “Trial sandboxes only. Synthetic data, no federal data, no connection to Department systems except single sign-on.”

“I have signed one LOW ATO in three years.” She flipped a page. “Convince me this isn’t four ways to skip the work.”

“It’s the same rigor, matched to the risk,” Marcus said. “Each vendor is FedRAMP 20x Class A certified, and the evidence is on their trust centers, current within the week. The authorizations expire when the trials end. If a vendor’s certification lapses, we shut its sandbox off.”

“And what stops someone from uploading a real spreadsheet?”

“Rules of engagement, signed by every tester,” Tomás said. “And Marcus spot-checks the sandboxes weekly.”

Dr. Ruiz was quiet for a while. “One condition. The first time real data touches any of these, I hear about it from you, not from an incident report.”

“Agreed,” Marcus said.

She signed all four, slowly, reading each signature block, and slid them back across the desk. “I still think it’s too many,” she said. “But I can’t find the flaw.”

5. The Trials

The trials ran for three weeks. Priya’s team ran the same six workflows in every sandbox: import a control baseline, assign an owner, attach evidence, generate a POA&M, run a report for a fake auditor, and offboard a user. One vendor’s evidence workflow made the analysts groan. Another had a beautiful dashboard and an export function that mangled every spreadsheet. A third was fine. The fourth, Northlight, made Priya’s most skeptical analyst say, out loud, “Oh, that’s nice.”

By the end of week three the decision was easy, and it was based on hands-on use rather than a sales deck. Nobody had signed a multi-year contract. Nobody had risked a byte of real data.

“We picked the right one,” Priya told Marcus. “I actually believe it.”

6. The Call

They made the call on a Friday afternoon, with Tomás on the line as an observer and Marcus’s laptop propped against a stack of binders nobody had opened in weeks.

On the other end were Northlight’s CEO, Renata Vasquez, and its head of security, Kofi Adeyemi. Both looked like people who had been told there would be good news and were trying not to hope too hard.

“We’re calling to tell you that you won,” Priya said. “Our team ran four products through the same six workflows. Northlight came out on top.”

Renata exhaled. “You have no idea what that means to us. You’d be our first federal customer.”

“That’s actually why we’re calling,” Marcus said. “You’re certified at Class A. Our AO will authorize this for production, but for anything beyond a small, low-risk footprint, she is going to ask the question everyone asks: how long from Class A to Class C?”

Kofi didn’t need to look anything up. “Faster than you’d think. Most of Class C is already how we operate. We do the logging, the change control, the incident response, the access reviews. What we didn’t have was the paperwork and the independent assessment to prove it.”

“Why not?” Priya asked, not unkindly.

“Money and sequence,” Renata said. “An assessment plus a full package is a serious investment, and until today we had no federal customer to justify it. Class A let us get in the door with what we already had: our SOC 2, the seven Key Security Indicators, the trust center. But we weren’t going to spend a year of runway on Class C for a customer who didn’t exist yet.”

“And now you have one,” Tomás said quietly.

“Now I can take a signed contract to my board and to our lenders. That unlocks the budget, and Kofi can hire the assessor and the engineering help he’s been asking for since spring.”

Marcus leaned in. “Give me dates.”

Kofi and Renata glanced at each other. “Class B in two months,” Kofi said. “Class C in four. We’ll have to be disciplined, but we’re not starting from zero. We’re finishing.”

Priya looked at Marcus. In the old world, this was the moment the deal fell apart: a vendor without the right paperwork was a vendor you couldn’t buy from. Now the paperwork was just a schedule.

“Here’s what we can do,” Priya said. “We’ll award the contract on your Class A certification. The trial program continues the way it is now, synthetic data only, inside the boundary we’ve already authorized. And the contract will include two milestones: Class B within two months, Class C within four.”

“Milestones we can be measured against,” Marcus added. “If they’re met, we expand what Northlight is allowed to hold. If they slip, the trust center will show it, and we’ll pause and reassess.”

“That’s fair,” Renata said. “It keeps us honest.”

When the call ended, Priya sat back and looked at the ceiling. “We just bought a product from a company that told us, to our faces, what it can’t do yet, and when it will.”

“That’s the whole idea,” Tomás said. “You don’t have to find out later.”

7. The Package

Now came the part Marcus had dreaded most. The four trial ATOs had been quick because nothing real was inside them. The production package would be different, and it would be for Northlight alone. The other three sandboxes were left to expire on schedule.

With Northlight selected, he opened its trust center and read the certification package the way he would read any authorization package: skeptically. The seven Key Security Indicators were there, each with its evidence, validated by the provider within the past week. The underlying SOC 2 Type II report and bridge letter sat alongside. The incident-reporting procedure was documented, and the ongoing reporting schedule showed the date of the next quarterly report.

“The evidence is current,” he told Priya. “That’s what I’m not used to. Normally I’m reading a snapshot from eight months ago.”

He worked through the agency side of the ATO methodically, and Tomás checked each step against the process:

1. Categorize, revisited for production use, starting from the FIPS 199 worksheet from the trial phase.
2. Select controls: the Department’s own baseline, tailored for a moderate-impact SaaS system. The controls implemented by Northlight are tailored out of the baseline so that the SSP accurately reflects the Agency’s role.
3. Implement: the agency-side responsibilities. Single sign-on through the Department’s identity provider, role assignments, data-handling rules, and the connection to the Department’s logging.
4. Assess: Marcus’s own review of the package, plus a small agency test of the configuration: does SSO enforce phishing-resistant MFA, do the logs land where they should, can a departed user still get in?
5. Authorize: the decision, made by someone with the authority to accept the risk.
6. Monitor: an ongoing feed, not an annual scramble.

The assessment turned up two findings: a role that was broader than it needed to be, and a logging field that wasn’t mapped. Marcus fixed both in an afternoon and recorded them, with dates, in a POA&M that was closed before it was ever opened for review.

He wrote the security assessment report on a Thursday. It was eleven pages long.

8. The Briefing

Dr. Ruiz had signed the four trial ATOs with visible reluctance, and she had not stopped watching them. For the production decision she wanted the whole picture, and she was known for wanting it in writing.

Marcus and Priya prepared the way people prepare for a hard exam. They rehearsed with Tomás, who played the AO and was, by his own admission, much nicer than the real one.

“She’s going to ask why this is safe,” Tomás said. “Don’t answer with ‘because it’s FedRAMP certified.’”

“Because certification isn’t an attestation of security,” Marcus said. “It just means the information we need to make a risk-based decision is available.”

“Right. Certification is evidence. Your job is to show her what the evidence says about risk to the Department and what you’ve done about the remainder.”

So the briefing was built around the decision she actually had to make, in four short pieces. What the system is and what data it holds. What the provider has independently demonstrated, and how recently. What the agency added: the configuration, the two findings, and their closure. And what risk remains, with the reasons it was acceptable and the triggers that would make it not acceptable?

Dr. Ruiz listened. She asked how quickly Northlight would tell the Department about an incident, and Marcus pulled the answer straight from the trust center’s reporting rules. She asked who could see the data, and Priya showed the role model. She asked what happened if the provider’s certification lapsed, and Marcus had a plan: the trust center feed would flag it, the agency would be notified, and a defined review would follow.

She turned to the contract. “Northlight is certified at Class A. Why should I authorize a production system on that?”

“Because the ATO covers what Class A supports today, and nothing more,” Marcus said. “Northlight has committed to Class B in two months and Class C in four. Both dates are in the contract, and the trust center will show us where they stand. Until a milestone is met, the data boundary doesn’t change.”

“And if they miss one?”

“We pause any expansion, and you get a briefing before we decide anything else.”

Dr. Ruiz wrote the two dates in the margin of her copy.

Then she asked the question they hadn’t rehearsed. “How did you choose this vendor?”

Priya didn’t hesitate. “We didn’t guess. We tried four of them and selected the one that best meets our needs.”

Dr. Ruiz looked at her for a long moment. “In this building,” she said, “that is not a sentence I hear often.”

9. The Signature

She signed on a Tuesday, eleven weeks after Priya’s forty-one-row spreadsheet. The ATO letter named the system, the boundary, the conditions, and the review triggers. It was short enough to read in one sitting.

“Eleven weeks,” Dr. Ruiz said, handing the memo back. “I want every team in this Department to hear how you did this. You lowered the risk before you spent the money, and you let the evidence do the arguing.”

Tomás, standing at the back of the room, allowed himself a small smile.

Afterward, in the hallway, Priya asked Marcus whether he was relieved.

“Relieved, yes. Done, no.” He held up his phone, where the trust center feed had just delivered a notification: Northlight’s next ongoing certification report was scheduled for the end of the quarter. “This is the part that used to be a cliff. Now it’s a stream. Quarterly reports come in, I read them, and if anything changes in their risk, I hear about it. If our own use changes, say we start putting real assessment data in there or connect it to something bigger, we revisit the categorization and the ATO before we do.”

“And the upgrades?”

“Class B in two months, Class C in four. Those dates are in the contract and in the ATO’s review triggers. If Northlight misses one, the trust center shows it, and Dr. Ruiz gets a briefing before anyone gets more access. If they hit them, the same evidence carries us up.”

Priya looked at the empty fourth-floor conference room, at the broken thermostat, at the whiteboard where, on the day of the kickoff, she had written 14 MONTHS?! in red. Someone had drawn a line through it and written, underneath, in Marcus’s cramped handwriting, 11 weeks.

She took a photo of it, and then, because it was Priya, she started a new spreadsheet: the next tool the Department needed to try.