Class A
Initial entry
$7,500
One-time engagement fee
- Automated drafting of every required control and objective
- Automated SSP assembly
- Automated POA&M generation
- Link and organize your evidence
- Prepare the full package for your 3PAO
- A portal with everything below
- SSP
- POA&Ms
- Control documentation
- Evidence index
- 90 days of assessment support
- We answer your 3PAO’s questions directly
- Evidence pulled and sent on request
- Findings addressed and resubmitted
- Package updated as the assessor comes back
Class B
Light agency use
$45,000
One-time engagement fee
- Automated drafting of every required control and objective
- Automated SSP assembly
- Automated POA&M generation
- Link and organize your evidence
- Prepare the full package for your 3PAO
- A portal with everything below
- SSP
- POA&Ms
- Control documentation
- Evidence index
- 90 days of assessment support
- We answer your 3PAO’s questions directly
- Evidence pulled and sent on request
- Findings addressed and resubmitted
- Package updated as the assessor comes back
Class C
Enterprise agency use
$60,000
One-time engagement fee
- Automated drafting of every required control and objective
- Automated SSP assembly
- Automated POA&M generation
- Link and organize your evidence
- Prepare the full package for your 3PAO
- A portal with everything below
- SSP
- POA&Ms
- Control documentation
- Evidence index
- 120 days of assessment support
- We answer your 3PAO’s questions directly
- Evidence pulled and sent on request
- Findings addressed and resubmitted
- Package updated as the assessor comes back
Not sure which class applies? The free assessment tells you.
Your 3PAO assessor fee is paid directly to your assessor and is not part of what Verdict charges. We will tell you what to expect before you commit to anything. The whole bill, assessor included, is set out line by line in how much FedRAMP certification costs. Already part-way through with another provider? See transferring a FedRAMP engagement.
Five steps to your 3PAO
Our people run this on software we built and operate ourselves. There is nothing for your team to install, configure, or staff, and the only step that belongs to you is the one that has to.
Intake
Our proprietary software, Keystone, collects the information about your system.
Gap assessment
Keystone compiles it and identifies where you fall short of the required controls.
Remediation
You fix the gaps in your environment. We tell you exactly what closes each one.
Documentation
Keystone drafts every control statement, assembles your SSP, and generates POA&Ms for anything still open.
Handoff
We package it and deliver it to your 3PAO.
Months, where it used to be years
Unlike the fees above, this section is about the programme rather than about anybody who works in it. It is the route getting shorter, not one provider being quicker than another.
Cabrillo Club puts the legacy route at 18 to 24 months end to end, against a 660 day program average, and puts 20x at 90 to 180 days on pilot data. The first provider through the 20x process finished in 119 days.
UberEther reports that some providers in Phase 1 reached authorization in roughly three months, against 18 or more months as the legacy norm, from 26 complete packages and 13 completed reviews in that phase.
The chart below holds one measure on one axis: calendar days from starting to holding the designation. Review time is a different measure and is kept out of it deliberately, because a five week review bar sitting next to a 660 day end-to-end bar invites a comparison that is not there. Those figures are below the chart instead.
| Figure | Published as | Source |
|---|---|---|
| Legacy path, end to end | 18 to 24 months18-24 months end-to-end | Cabrillo Club |
| FedRAMP 20x, end to end | 90 to 180 days90-180 days end-to-end (pilot data) | Cabrillo Club |
Typical agency authorization review time, reported by the program itself.
The average agency authorization review queue remains under 15 cloud services with a typical review time of under five weeks.
FedRAMP
Cloud services authorized in six months, against fewer than 350 in the program’s first ten years.
We authorized 100+ cloud services in the past six months
FedRAMP
What some providers took in Phase 1, against 18+ months before it.
some participating providers achieved authorization in roughly three months during Phase 1
UberEther
How long the agency route runs from initiation to authorization.
typically spans 12 to 36 months from initiation to authorization
Knox Systems
What our own timeline measures
The timeline we publish is not the same measure as any figure above it. Ours is the preparation: from starting an engagement to handing a finished package to your 3PAO. Class A runs 3 to 5 weeks, Classes B and C run 6 to 8 weeks. What happens after that belongs to other people. The assessment is the 3PAO’s, and the review window is the program’s.
We prepare, we do not assess and we do not certify. So the honest way to read the two sets of numbers together is this: the program has taken the back half of the route from years down to months, and our part of the front half is measured in weeks. Neither one is a promise about your system, and neither one is a schedule we can commit to before seeing your boundary.