FedRAMP and CMMC Controversies

Stefan Coetzeecreated 2026-05-12updated 2026-06-081 min readcross-cutting
Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

FedRAMP cost and timeline

  • Authorization timeline 12-18 months.
  • Cost $300k-1M+ for assessment.
  • $200k-500k+ annual continuous monitoring.
  • Smaller cloud providers gated.

CMMC implementation lag

CMMC 1.0 announced 2020; CMMC 2.0 simplified; full rollout phased through 2028:

  • Industry investment uncertainty.
  • C3PAO capacity bottleneck.
  • Smaller DoD contractor burden.

3PAO / C3PAO capacity

Limited certified assessor pool:

  • Demand exceeds supply.
  • Schedule pressure.
  • Cost pressure.

FedRAMP authorization concentration

JAB authorizations few; agency authorizations fragmented:

  • Reciprocity imperfect.
  • Multi-agency use cases complicated.

CMMC scope ambiguity

CUI scoping challenges:

  • What is CUI varies by agency.
  • Contractor scope decisions consequential.
  • Boundary uncertainty.

Smaller-contractor burden

Both programs burden smaller orgs:

  • CMMC Level 2 self-attestation reduces but doesn't eliminate.
  • FedRAMP largely inaccessible to small SaaS.

Counterpoint

  • Genuine federal procurement security uplift.
  • NIST 800-53 / 800-171 technical foundation strong.
  • CMMC 2.0 proportional approach improvement over 1.0.
  • FedRAMP continuous monitoring meaningful.

See also