The Three Speeds

Same framework, three gears

Lesson 1.1 gave you the honest range: six months to three years for a traditional authorization, weeks for delivery onto the right platform, and a stated industry direction where the question answers itself continuously. Those aren’t three frameworks — they’re three gears of the same RMF. The first two vary one axis (how much of the package was already authorized before you arrived); the third varies another (how often the acceptance itself happens). Programs mix them — the gears are a planning shorthand, not a taxonomy — and the shorthand’s one variable is: how much answering is left for you to do.

GEAR 1: TRADITIONAL         you answer for EVERYTHING - every control,
        (6mo - 3yr)         every statement, a full assessment, a full
                            package to one AO. Most of the time is
                            waiting for assessment and review, not
                            engineering.

GEAR 2: INHERITANCE         a PLATFORM answered for most controls
        (days - weeks)      already; you answer for your delta. The
                            package shrinks; the assessment shrinks;
                            the SCOPE of the AO decision shrinks
                            (the responsibility does not). Module 4
                            tours the platforms.

GEAR 3: CONTINUOUS          the package updates itself from pipeline
        (aspiration w/      evidence and the authorization is an
        real exemplars)     ongoing state, not an event. Module 6
                            takes this seriously - including how far
                            it actually is from most shops' reality.

”ATO in a day” decoded

You will hear the phrase constantly, usually from a vendor deck — and commercial readers already know the mechanism under its cloud name, the shared-responsibility model: the provider answers for the layers it runs, you answer for what you build on top — with one federal difference: a provider’s controls count as inherited only once they have been assessed and authorized, so the model is the same shape but the paperwork is not optional. Here is the decode, and it never fails: “ATO in a day” means inheritance in a day. The day-long part is authorizing your delta on a platform whose own authorization took someone else years. The exemplar numbers worth knowing, because they show the model working at both scales: cloud-platform programs report workload authorization in roughly fifteen minutes on a certified pipeline, and about thirty days to stand up a compliant landing zone — against the twelve-to-eighteen-month baseline the same programs quote for doing it from scratch (these are one DoD platform program’s public figures; treat them as illustrative of the ratio, not as quotas). Reusable-authorization schemes (Certificates to Field — a DoD construct that lets a once-approved component carry its approval to other environments on the same platform — and similar constructs elsewhere) are the same move formalized: authorize the pipeline and platform once, then let conforming workloads inherit.

Nothing about the risk disappeared — it moved into the platform’s package, where it’s answered once instead of hundreds of times. That’s the whole trick — and for leadership it is the entire business case: every control the platform already answers for is assessor time you do not wait on and statements you do not write, which is why a delta-only delivery ships in weeks against a from-scratch package’s year or more. Lesson 4.3 examines what the platforms actually demand of your software in exchange.

The arithmetic that explains federal policy

Why does the slow gear exist at all? Here’s the number that reframes it: the FedRAMP program — the authorization machinery for the entire federal cloud marketplace — operates with on the order of fifty recognized assessment organizations listed to serve it. Set that against hundreds of cloud services seeking authorization and every agency needing its packages reviewed, and you get the load-bearing fact of this entire domain:

Assessor throughput is the binding constraint. Every major authorization reform of the last five years — inheritance platforms, reusable certificates, machine-readable packages, risk-based tailoring — is, at bottom, an attempt to spend scarce assessor-hours on deltas instead of repetition.

This gives you a predictive tool, not just an explanation. When you read any new authorization policy, ask: does this reduce assessor-hours per authorized system? If yes, expect it to advance. If it adds review burden — however virtuous — expect it to stall. Module 4’s landscape (a certification program suspended over exactly this arithmetic, an entire rewrite built around assessment-scope minimization) will keep proving the rule. And it’s why Module 6’s rollout lesson plans your program around assessor capacity as a first-class constraint, the way you’d plan around any scarce dependency.

Prompt first: gear selection

We deliver [describe your software] into [agency/context]. Build a
gear-selection brief:
1) list the inheritance platforms plausibly available to us in this
   context (agency platform offerings, DoD software factories - the
   authorized build-and-run platforms, authorized cloud landing zones -
   pre-approved account and network scaffolding) and what each would
   answer for;
2) estimate our DELTA on each - the controls we would still own
   (application-layer, data handling, our pipeline) - as a fraction
   of a moderate baseline;
3) give the honest recommendation: which gear, what we must build
   before approaching the platform (their intake requirements), and
   what timeline range to put in front of leadership - as a RANGE,
   with the assessor-capacity caveat attached.

The output’s third section is your defense against the meeting where someone quotes a vendor’s “day one authorization” line as a schedule commitment.

Practice status — among mature regulated delivery programs, commercial and federal

(a few rows carry a more specific status - principle, canon, suspended - where one of the five would mislead)

Scale: required | common baseline | strong optional | reference-shop (seen only at organizations that publish their own practice) | emerging

Key takeaway

Three gears, one framework: traditional (you answer for everything), inheritance (a platform answered first; you answer for the delta), continuous (the answering never stops — Module 6’s honest subject). “ATO in a day” is always an inheritance claim. And behind every policy in this domain sits one number — assessor throughput — that predicts which reforms advance and which stall. You now hold the map; next module, we turn controls into data.

LEADERSHIP DECISION   pick the gear deliberately and fund toward the
                      platform's intake requirements - never accept 'ATO in a
                      day' as a schedule
PRACTITIONER ACTION   produce the gear-selection brief: candidate platforms,
                      the delta you would still own, a timeline RANGE with the
                      assessor-capacity caveat
SUCCESS MEASURE       authorization timeline committed as a calendar range
                      with the delta enumerated; zero schedule commitments
                      built on an 'ATO in a day' claim