[cuuupid]

> Not criticizing FedRAMP

Think it's very important to criticize FedRAMP. The FedRAMP board is extremely slow moving and continuously disregards industry feedback. As a result, FedRAMP is essentially a Palantir tax, where nearly every startup hoping to sell to government (including larger ones like Anthropic, xAI, Cognition AND OpenAI) is forced to pay Palantir to deploy in their FedRAMP enclave. This has a sticker price of 200-500k/y before we get into compute premiums.

Going through FedRAMP yourself requires a staff who is willing to put in a dedicated effort on the compliance paperwork (not the controls, which you could knock out in ~1mo easily, just the paperwork) for 6-8mo before getting into a line to hopefully get a 3PAO audit and then remediations followed by another audit which is followed by needing to get agency sponsorship for a FedRAMP board review. This costs $2-3M minimum including the amount of security software needed for evidencing and policy, which rules out nearly every small business. This process also can easily take 2-3 years of waiting, which forces out enterprise. So anyone entering the ecosystem is essentially forced to pay Palantir (or 2F which is a distant 2nd) a tax that is entirely enforced by government regulation.

They are not any kind of 'Federal Cyber Experts' either as that work is primarily outsourced to Schellman etc.

[bigfatkitten]

> FedRAMP is essentially a Palantir tax, where nearly every startup hoping to sell to government (including larger ones like Anthropic, xAI, Cognition AND OpenAI) is forced to pay Palantir to deploy in their FedRAMP enclave

Having been through FedRAMP twice, I can this is absolute fiction. What does Palantir have to do with anything?

[cuuupid]

Palantir FedStart is a new program, and a quick look at the FedRAMP marketplace will show you there are literally 0 tech startups listed that are there without jumping on Palantir’s ATO. I find it difficult to believe you have been through FedRAMP twice but would declare something as ‘absolute fiction’ when it can be easily proven

[bigfatkitten]

We obtained an ATO in our own right, which is slow but otherwise really not that hard.

[firesteelrain]

> Going through FedRAMP yourself requires a staff who is willing to put in a dedicated effort on the compliance paperwork

But couldn’t you say the same for CMMC 2.0, NIST 800-171, RMF, JSIG, STIG, etc?

[cuuupid]

I am, CMMC 2.0 requires and is essentially satisfied by FedRAMP Moderate, and NIST 800-171 is a subset of FedRAMP. Notably both CMMC and FedRAMP were met with immense criticism from industry which was mostly ignored.

It would be better to compare this to commercial, like SOC 2, which is achievable even for small startups without much effort and on much more affordable budgets.

Notably SOC 2 full service is $20k including tooling (Vanta + Workstreet + audits), NIST is $20-30k (Vanta + partners), while FedRAMP is $500k-1M (Coalfire) just for implementation before getting into tooling and audits.