Updated June 2026 — Three material developments:
(1) FedRAMP renamed “Authorization” → “Certification” (May 4, 2026) and replaced Low/Moderate/High impact-level terminology with Classes A/B/C/D. The substantive control baselines are unchanged. This article uses “Moderate” and “Authorization” throughout for searchability and continuity with operating CSPs’ documentation, with the new terminology noted where context requires. Every customer-facing FedRAMP claim, SSP cover sheet, and 3PAO marketing piece on the open web is now subtly out-of-date until refreshed.
(2) FedRAMP 20x Phase 3 finalization on track for June 30, 2026. Phase 2 wrapped March 31 with the targeted ~10 Moderate pilot authorizations completed via automated validation against Key Security Indicators (KSIs) instead of manual 3PAO attestation across every control. Phase 3 formalizes all 20x Low and Moderate requirements; the public submission pipeline opens FY26 Q4 (July-September). 3PAO 20x accreditation finalization is part of the Phase 3 close-out. Pilots completed in Phase 2 ran materially faster than the 12-18 month traditional path described below.
(3) The traditional path covered in this article remains accurate and is still the dominant route in 2026 — but if you’re starting a FedRAMP Moderate engagement now, it’s worth evaluating 20x as an alternative. Our Q2 2026 compliance landscape briefing covers the 20x structural changes and the May 4 terminology change in its June 5 mid-Q2 update; our FedRAMP 20x deep-dive is the full treatment — the KSI model, the phased rollout, and the decision criteria for traditional-vs-20x.
“How long does FedRAMP Moderate actually take?” is the first question on most CSP scoping calls. The honest answer is twelve to eighteen months, but the real answer depends on three variables the CSP controls (architectural readiness, documentation discipline, federal operations staffing) and two variables they do not (sponsor responsiveness, 3PAO availability).
This article breaks the FedRAMP Moderate engagement down month by month. It reflects what we actually run in our FedRAMP practice — not a GSA-published workflow diagram. If you are a cloud service provider mapping out your first federal authorization, the sections below let you check your timeline against practitioner reality.
The three phases
FedRAMP Moderate authorization breaks into three phases with distinct cadences:
- Preparation (months 1–6): sponsor engagement, boundary design, System Security Plan drafting, initial technical implementation
- Assessment (months 6–10): 3PAO security assessment, findings remediation, Security Assessment Report delivery
- Authorization (months 10–18): Agency or JAB review, authorization decision, initial continuous monitoring
The overall elapsed time compresses or expands based on which path you pursue. Agency ATO typically lands at 12–15 months. JAB P-ATO typically lands at 18–24+ months because the JAB review process adds at least six months to the back end.
Month 0 — Sponsor engagement
Before the clock really starts, the CSP needs a named sponsor willing to commit to the Agency ATO path (or acceptance onto the JAB prioritization list for P-ATO path).
The sponsor is almost always a specific federal customer with a pending procurement that depends on your service being authorized. The sponsor provides:
- The ATO itself — the sponsoring agency issues the Agency ATO at the end of the process
- Initial scoping and boundary feedback — what workloads the sponsor cares about determines your authorization boundary
- A named technical point of contact — typically a senior IT leader or security engineer who walks through package reviews with your team
- A named program point of contact — someone with procurement context who keeps the authorization aligned with contract schedule
Finding the sponsor is usually the first constrained resource. Many CSPs know they need FedRAMP; fewer have identified which agency will sponsor them. If you do not have a sponsor, the first two months of the engagement are often spent finding one.
Months 1–3 — Boundary and package scaffolding
With the sponsor engaged, the technical work begins in earnest.
Authorization boundary definition. The boundary is the set of system components covered by the authorization. Drawing it is genuinely hard — include too much and the authorization effort balloons; include too little and the sponsor rejects the scope. Boundary definition typically takes four to six weeks and requires close collaboration between engineering, operations, and the sponsor’s technical lead.
System Security Plan (SSP) draft. The SSP is the central artifact — a 300-to-500-page document describing how each of the 325 Moderate baseline controls is implemented. Writing it from scratch is impractical; most CSPs start from the FedRAMP SSP template and customize. First draft typically reaches 70% complete by month 3.
Initial technical implementation. For CSPs already running in GovCloud, GCC High, or equivalent, most technical controls are partially in place. The remaining work is the specific FedRAMP overlay — FIPS 140-2/3 validated cryptographic modules deployed, continuous-monitoring instrumentation installed, logging pipeline satisfying the event types FedRAMP requires, vulnerability management at the cadence FedRAMP requires.
ConMon architecture. Continuous monitoring is the post-authorization operational commitment. Designing it during initial preparation is substantially cheaper than retrofitting after ATO. The ConMon architecture covers monthly vulnerability scans, quarterly POA&M updates, annual control self-assessments, and the reporting pipeline to the FedRAMP PMO.
Months 4–6 — Documentation, gap remediation, 3PAO selection
This is where CSPs most commonly underinvest and pay for it later.
Documentation finalization. SSP, Information Security Policies, Incident Response Plan, Configuration Management Plan, Continuous Monitoring Strategy, Contingency Plan, Training program, and 20+ supporting documents. Each has a template; each requires customization to your environment. If documentation is treated as a final-month sprint, the quality shows.
Gap remediation. The gap analysis from month 1–2 produced a list of missing controls. Month 4–6 closes them. Controls that take longer typically include: federal-operator personnel security (background checks, U.S.-citizen verification for privileged operators), FIPS 140-2/3 cryptographic module validation where commercial software does not automatically use validated modules, and documentation of data flows that were previously informal.
3PAO selection and engagement. The Third-Party Assessment Organization conducts the security assessment. Available 3PAOs are listed on the FedRAMP Marketplace. Engagement typically requires 4–8 weeks from selection to assessment kickoff — booking is non-trivial, particularly for higher-demand firms. Start 3PAO engagement by month 4 at the latest.
Months 6–9 — 3PAO security assessment
The 3PAO conducts an independent assessment of your controls as documented. The assessment has three phases:
Planning (weeks 1–2). The 3PAO reviews your SSP, boundary definitions, and supporting documentation. They produce a Security Assessment Plan (SAP) detailing scope, approach, and schedule.
Testing (weeks 3–8). The 3PAO tests controls through interviews, technical observations, and evidence review. Findings are documented in the Security Assessment Report (SAR). Expect the 3PAO to interview 10–30 personnel across engineering, operations, security, HR, and executive leadership — the federal operations team is particularly scrutinized.
Reporting (weeks 9–12). The 3PAO produces the SAR describing findings, testing methodology, and the initial Plan of Action and Milestones (POA&M). CSPs remediate critical and high findings during this window where possible to avoid extending the engagement.
Findings are normal. First-time CSPs typically have 20–60 findings in the initial assessment, most of them minor. Critical findings that block authorization are less common if preparation was thorough — and they are the primary reason CSPs who rushed preparation spend an extra 3–6 months.
Months 9–12 — Agency ATO review (Agency path)
With the 3PAO assessment complete, the authorization package goes to the sponsor agency for review. The package includes SSP, SAR, POA&M, all supporting policies, and assessor attestation.
Agency review typically takes 2–6 months depending on the agency’s internal capacity. Some agencies have dedicated FedRAMP review teams with relatively predictable cadence; others review authorization packages alongside other security reviews and have more variable schedules.
Interactions during review. Agency reviewers ask clarifying questions, request additional evidence, and sometimes require documentation updates. A dedicated program manager on the CSP side accelerates this phase significantly — an unanswered question can stall an agency review for weeks.
Authorization decision. The sponsor agency issues the ATO when satisfied. The authorization covers the specific agency customer for the specific workload boundary; other agencies can adopt the authorization under separate inter-agency acceptance processes.
Months 10–18 — JAB P-ATO review (JAB path, alternative)
The JAB P-ATO path runs longer. The JAB (Joint Authorization Board) is a cross-agency body that conducts its own review rather than relying on a single sponsoring agency.
Prioritization list entry. You must be accepted onto the JAB’s prioritization list, which is a competitive process. Not all CSPs get on it. Acceptance has historically been granted to CSPs with broad federal applicability (many potential customers) and strong operational maturity.
Preliminary review. The JAB conducts a preliminary review to confirm the package is structurally ready for formal review.
Formal review. Technical review by JAB-designated reviewers covers the SSP, SAR, and POA&M in depth. Formal review typically takes 3–6 months.
Authorization decision. The JAB issues the P-ATO if satisfied. Unlike Agency ATO, the JAB P-ATO is a Provisional Authorization — each agency still makes its own authorization-use decision, but the JAB P-ATO substantially reduces what each agency has to review.
The JAB path adds 6–12 months compared to Agency ATO but produces authorization that is portable across federal customers without re-review.
Continuous monitoring begins at ATO
Authorization is not the end. From day one of ATO, continuous monitoring obligations begin:
- Monthly vulnerability scans with results reported to the authorizing agency or JAB
- Quarterly POA&M updates tracking remediation progress on known findings
- Annual control self-assessment documented in the POA&M
- Continuous incident reporting with defined severity thresholds and reporting cadences
- System change notifications when architecture or boundary changes occur
ConMon is where authorizations get revoked. A CSP that passed initial assessment and then underinvests in ongoing operations can lose authorization within 12 months. The operational team that handles ConMon typically stands up during months 3–6 of the initial authorization so it has operational history by the time ATO is granted.
The common delays
Across our engagements, four delay patterns repeat:
Sponsor unresponsiveness. Every CSP encounters at least one three-to-eight-week stall where the sponsor’s review simply does not move. Budget for this in the overall timeline — do not budget for constant progress.
3PAO availability. Well-regarded 3PAOs are booked months ahead. Late engagement delays the start of the assessment phase, and the assessment phase is on the critical path.
Boundary scope drift. Mid-engagement discovery that a system component is in scope when it was assumed not to be. This adds weeks of documentation and testing to whatever phase you are in.
Personnel security gaps. U.S.-citizen verification for privileged operators takes months to establish cleanly if the team has globally distributed engineering. Discovered late, this blocks the assessment phase.
How to compress the timeline
If you need faster than 15 months, the compressible levers:
- Start with a well-regarded 3PAO pre-booked. Saves 4–8 weeks.
- Engage a FedRAMP consultant during boundary definition. Boundary rework costs weeks to months; getting it right the first time is meaningful acceleration.
- Run FedRAMP preparation alongside (not after) CMMC / SOC 2 / ISO programs. Controls overlap; evidence pipelines are shared.
- Staff the federal operations team before authorization. Trying to hire ConMon operators during the last 30 days before ATO leads to weak continuous-monitoring maturity at ATO and risks post-ATO findings.
- Pick Agency ATO over JAB P-ATO. Agency is typically 3–6 months faster.
Compressed engagements can land at 10–12 months with discipline. Faster is typically not achievable without cutting quality.
When to engage
The inflection point for bringing in outside FedRAMP advisory is during boundary definition, before the SSP is drafted. Boundary decisions made at this phase cascade through the entire authorization package. If you engage a consultant during boundary design, the first pass at SSP is much closer to passable than if you started alone.
Our FedRAMP and DoD CC SRG practice covers both the Moderate authorization process and the DoD ladder above it — IL4, IL5, IL6. If you foresee DoD work within 24 months, see the FedRAMP to IL4/IL5 upgrade path for sequencing that avoids rework.
Related reading: FedRAMP to IL4/IL5 upgrade path · Inside an IL5 assessment: controls that burn CSPs first