[aduffy]

I expect as much. Having going through FedRAMP before, the alternative would be to make their regular commercial infrastructure be up to FedRAMP standards, which is incredibly onerous (things like change tracking, DR, US Citizen access only to production systems, etc.)

[dylan604]

> US Citizen access only to production systems,

What if the employees building the thing are not US citizens?

[aduffy]

The thing about FedRAMP is that it's not one thing, it's a framework. Even if you have a FedRAMP package for a system, you need a fresh ATO to use it at any customer.

Technically, there is no citizenship requirement for FedRAMP.

In reality, at every US Government customer I'm aware of, US Persons (Citizen or PermRes) are the only ones that can deploy code to production. You can have non-USP writing code but it must be reviewed and rolled out by USP.

[sitzkrieg]

now now, no one wants to call out the unwillingness to pay fair labor cost of the sausage machine :^)