The default mistake: GovCloud everything, day one
The reflex when a defense contract appears: lift-and-shift everything into AWS GovCloud or Azure Government. That's a five-to-seven-figure mistake for most early-stage startups. CMMC Level 2 does not require GovCloud. It requires a FedRAMP Moderate-equivalent environment for storing, processing, or transmitting CUI — and FedRAMP Moderate is achievable in commercial AWS / Azure with the right configuration.
Where you do need GovCloud / Azure Gov: ITAR data (see ITAR vs CUI), explicit DoD impact level 4/5 requirements in the contract, or when your CUI must be processed by personnel cleared as U.S. persons in a region with enforced sovereignty. Otherwise, a properly-configured commercial cloud enclave with customer-managed keys is compliant and a fraction of the cost.
The cloud-native advantage: IaC as evidence
- Terraform / Pulumi / CloudFormation modules ARE configuration baseline evidence — version-controlled, reviewable, immutable.
- Pull requests are change management. GitHub branch protection IS the documented approval workflow.
- CI/CD pipelines produce SBOMs, vulnerability scans, and deployment logs that drop straight into your evidence collection pipeline.
- You don't need a separate GRC tool to "document" what your IaC already documents. Point the assessor at the repo.
- This is faster, cheaper, and more defensible than the legacy pattern of running a parallel docs-first workstream that never matches reality.
Control inheritance from FedRAMP SaaS
A meaningful chunk of NIST 800-171 controls can be inherited from FedRAMP-authorized cloud services. Microsoft 365 GCC High, AWS GovCloud, Google Workspace for Government, Box for Government — each publishes a Customer Responsibility Matrix (CRM) listing which controls they satisfy on your behalf and which you must implement yourself.
Use the CRMs as the spine of your SSP. For each control, the SSP entry should explicitly state: "Inherited from <provider>" or "Hybrid: provider does X, contractor does Y" or "Fully implemented by contractor." Assessors love this because it's verifiable in the FedRAMP authorization package.
Realistic 90-day path for a 30-person startup
- Weeks 1-2: Scope the CUI boundary. Identify the contract, identify the data, draw the enclave. Pick the cloud — commercial vs GovCloud — based on the actual data classification, not the default reflex.
- Weeks 3-6: Stand up the enclave. FIPS 140-2 / 140-3 encryption, MFA via FIDO2 hardware keys, dedicated identity tenant, isolated network. IaC every piece.
- Weeks 7-10: Generate SSP and POA&M from the running environment. Run a self-assessment to find the gaps. Remediate.
- Weeks 11-13: Mock assessment with a consultant or via Athena's binder workflow. Submit to SPRS. Schedule the C3PAO.
- Total cost for a 30-person, cloud-native shop with a single CUI contract: typically $40k-$120k, plus the C3PAO fee. Versus $250k+ for the legacy lift-and-shift path.