The road is already researched.
Here is what it says, sector by sector.
Every eight-week engagement reads the organization against the same researched road. This page shows that road: how a reading works, and for each sector the gates in its own words, the cloud bar, how long authorization usually takes, and the sources, with the date they were read.
One ladder, read from evidence.
51 positions in 12 service areas, each read on one ladder from 0 to 4, from evidence the organization already holds: 35 requests, existing material only. The engine proposes a level from the evidence; a consultant confirms or overrides it with a note; nothing is scored by a model.
| Level | Name | What it means |
|---|---|---|
| 0 | Reactive | Nothing defined; whatever happens, happens. |
| 1 | Inconsistent | Something exists or is done sometimes; no owner, no record that holds. |
| 2 | Defined | A named owner attests that a written practice operates, tied to a tracked item. An attestation is evidence at this level only; commentary is recorded as feedback, never as evidence. |
| 3 | Consistent | The practice is performed at its own stated interval, through the service-management framework, and consecutive records show it with follow-through. |
| 4 | Automated | The toolchain produces the evidence as often as the environment changes, humans in the loop, read on the PMO's cadence-driven executive dashboard. The target for a position depends on the change rate of the workloads it serves. |
Where a position stands below its target, the road names the work: 53 workstreams placed on a road of the organization's chosen length, and 64 jumpstart packages that start that work.
| Road | For | Horizons (months from kickoff) |
|---|---|---|
| 18 months | a small estate, well funded, moving fast | 0–3 · 3–8 · 8–13 · 13–18 |
| 24 months | a lighter estate with the means to move | 0–4 · 4–10 · 10–18 · 18–24 |
| 36 months | a measured road | 0–6 · 6–15 · 15–27 · 27–36 |
| 48 months | the standard road | 0–6 · 6–18 · 18–36 · 36–48 |
An authorization lead time is a floor the road does not compress: if a sector's authorization usually takes longer than the road allows, the gate is held at that lead time and the page says so.
Same method. Each sector's own terms.
The five gates on the road are the same everywhere; what they are called, who decides, and how long they take are not. Each reading below is dated; requirements change, and the engagement reads the current text.
Federal civilian · State, local and education · Defense industrial base · Pharmaceutical · Legal and e-discovery · Electric and water utilities
Federal civilian
The five gates, in this sector's words
- 1System categorized and bounded
The federal information system is categorized under FIPS 199 and its authorization boundary drawn; for a cloud service, the offering inside its FedRAMP boundary and the agency's own components around it.
Decidesthe system owner with the senior agency information security officer; the authorizing official approves the categorization - 2Assessment under way
The security assessment is scheduled against the package, or an interim authorization to test is granted where the agency uses one; for a cloud offering, its FedRAMP certification is in hand or in process.
Decidesthe agency authorizing official, on the assessor's plan - 3FedRAMP certification in hand
The cloud offering holds a FedRAMP certification the agency can reuse, Rev. 5 agency path or 20x Class A, B or C, and the agency's remaining responsibilities are written into its own package.
Decidesthe FedRAMP program certifies the offering; the agency decides its own use - 4Authorization to operate
The agency authorizing official grants the authorization decision on the package: system security plan, privacy plan, assessment report and plan of action and milestones, under A-130 and SP 800-37.
Decidesthe agency authorizing official, with the CIO and the senior agency information security officer advising - 5Ongoing authorization
Continuous monitoring feeds an ongoing authorization; the plan of action is kept current; for the offering, FedRAMP's continuous reporting stands in for a re-authorization cycle.
Decidesthe agency authorizing official on the continuous monitoring results
How long authorization usually takes
Jumpstart packages here
62 apply in full 2 in part · of 64
Sources, read 2026-10-13 · links checked 2026-10-15
- FedRAMP 20x, the current certification classes an agency reuses
- the agency's responsibilities under the 2026 consolidated rules
- NIST SP 800-37 Rev. 2, the RMF the authorization decision follows
- was taking more than six months for every system, with a long and growing backlog
- requires months of planning, scheduling, testing, documenting, and collaborating with various individuals and groups across CMS
- must undergo a security A&A at least every three (3) years or whenever there is a significant change
- Usage of the LATO process (90-Day, 1-Year Moderate, and 3-Year Low) is on an exception basis and requires GSA CISO approval
- The four (4) to six (6) month timeframe assumes that resources are available to start the security authorization process.
- Agency authorization timelines have also decreased in FY2018, averaging approximately 8 months compared to roughly 15 months in FY 2015.
- When the memo was released, FedRAMP faced a significant backlog, with authorizations taking over a year on average.
- The average agency authorization review queue remains under 15 cloud services with a typical review time of under five weeks.
- the JAB did not respond to their requests for updates on the status of the JAB’s review for several months
- In the FedRAMP Rev 5 Agency Authorization path, agencies work directly with a cloud service provider (CSP) for authorization.
- FedRAMP will stop processing Legacy FedRAMP Rev5 Certification applications on June 11, 2027
- FedRAMP will no longer accept applications for new FedRAMP Rev5 Certifications.
- If you have a complete FedRAMP Readiness Assessment Report or a SOC 2 Type II, you can submit for a Class A Certification
- August 31, 2026: FedRAMP 20x Class B and Class C pipelines open.
- Program Certification is provided directly by FedRAMP and does not require a federal agency to "sponsor" the service for FedRAMP Certification
- not to exceed twelve months, with the goal of more easily supporting a potential full FedRAMP authorization.
State, local and education
The five gates, in this sector's words
- 1Data classes and systems in scope
Systems and data stores are tagged by data class rather than by one impact level: criminal justice information, federal tax information, health, education records; each class brings its rule and its reviewer.
Decidesthe agency authorizing official; the CJIS Systems Agency for criminal justice information; the IRS Office of Safeguards for federal tax information - 2Provider status identified
For a cloud offering, the state program status required is identified and the provider's package requested: GovRAMP Ready, Core or Authorized, Fast Track from a FedRAMP package, or TX-RAMP certification.
Decidesthe agency, under the state's program rules - 3Provider authorized under the state program
The offering holds GovRAMP Authorized or Provisionally Authorized status, or a TX-RAMP certification, and the agency's own responsibilities are listed against the provider's.
Decidesthe sponsoring government authorizing official or the program's approvals committee; Texas DIR for TX-RAMP - 4Agency authorization and data-class approvals
The agency authorizing official accepts the system; for federal tax information the Safeguard Security Report stands with the IRS Office of Safeguards; for criminal justice information the CJIS agreements are signed; for an eligibility system, the CMS authority to connect.
Decidesthe agency authorizing official; the IRS Office of Safeguards; the CJIS Systems Agency; CMS for the Hub - 5Audits on their cycles
The CJIS Systems Agency's triennial audit, the IRS safeguard review, the state's IT security audits and the provider's annual program renewal keep the standing current.
Decidesthe auditors named; the agency responds
How long authorization usually takes
Jumpstart packages here
43 apply in full 21 in part · of 64
Sources, read 2026-10-13 · links checked 2026-10-15
- GovRAMP Authorized, the status a sponsoring authorizing official grants
- Fast Track, the reuse of a FedRAMP package
- the CJIS Security Policy, the criminal justice information rule
- IRS Publication 1075, the federal tax information rule
- Up to 12–18 months total typical timeline
- Once all required materials have been received, most reviews are completed within several weeks.
- Step 3: Assessment Activities (7 weeks)
- Ready Verification is the first stage that requires a Third-Party Assessment Organization (3PAO), introducing independent validation into your security journey.
- Assessed directly by the GovRAMP PMO, Core provides independent validation of your security posture—without the immediate need for a 3PAO assessment.
- the DIR goal is to complete that review and issue a recommendation within 4 weeks
- If your product is enrolled in GovRAMP’s Progressing Security Snapshot Program, it qualifies for TX-RAMP Provisional Certification.
- The FBI CJIS Division is authorized to conduct audits, once every three (3) years as a minimum
- At a minimum, triennially audit all external service providers which have access to the information system
- The purpose of the audit is to assess the user community’s compliance with the FBI CJIS Security Policy requirements
- Every agency with direct access to CJIS Systems will undergo a triennial audit
- WaTech Security Design Reviews (SDR) are required for maintenance and new development of systems and infrastructure projects under certain circumstances.
- must submit documentation to CDT that demonstrates planned cloud architecture, workforce, procurement, information assets, and security compliance
Defense industrial base
The five gates, in this sector's words
- 1Assessment scope defined
The CMMC Assessment Scope is drawn: CUI assets, security protection assets, contractor risk-managed assets, specialized assets, out-of-scope assets, with the enclave boundary and the cloud offerings that hold CUI named.
Decidesthe contractor's security lead, owned by the Affirming Official - 2Self-assessment posted
A NIST SP 800-171 self-assessment against the scope is complete and the score is posted in SPRS with its plan of action; this is the contractor's own reading before any assessor.
Decidesthe Affirming Official affirms; SPRS records - 3Assessment scheduled or conditional status
For Level 2, a C3PAO assessment is scheduled with the evidence ready, or a conditional status is held with the 180-day plan-of-action closeout running; for Level 1, the annual self-assessment stands in its place. Every cloud offering in scope is at FedRAMP Moderate or High with its customer responsibility matrix in the package.
Decidesthe C3PAO (Level 2), DIBCAC (Level 3) or the contractor itself (Level 1 and Level 2 self) - 4CMMC status held and affirmed
The final (or conditional) CMMC status at the contract's level is recorded in SPRS and the Affirming Official's affirmation is current; the contracting officer checks it before award.
Decidesthe Affirming Official; the contracting officer verifies - 5Annual affirmation and reassessment rhythm
The affirmation is renewed every year, the three-year reassessment is on the calendar, and a change that alters the scope triggers a new look; cloud offerings holding CUI stay at FedRAMP Moderate, or FedRAMP High where the data or the prime requires it.
Decidesthe Affirming Official, with the assessor at the three-year mark
How long authorization usually takes
Jumpstart packages here
23 apply in full 41 in part · of 64
Sources, read 2026-10-13 · links checked 2026-10-15
- 32 CFR 170, the CMMC program rule: assessment scope, levels, affirmation and the conditional status
- DFARS 252.204-7021, the contract clause that requires the CMMC status at award
- DFARS 252.204-7012(b)(2)(ii)(D), FedRAMP Moderate or equivalent for cloud offerings holding CUI
- No POA&Ms are permitted for CMMC Level 1.
- At the completion of a Level 1 self-assessment and annually thereafter, the Affirming Official shall submit a CMMC affirmation
- Level 1 self-assessments will be required on an annual basis
- The CMMC Program is paused in Phase 1 and may only require self-assessments at two levels.
- must post compliance results to SPRS within 180 days of the CMMC Status Date associated with the Conditional Level 2 (Self)
- The assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8;
- The Level 2 self-assessment must be completed every three years and the affirmation must be completed annually following the Final CMMC Status Date.
- The allowed designations are CMMC Level 1 (Self) or CMMC Level 2 (Self).
- Most organizations need 6 to 18 months to prepare for a Level 2 assessment.
- Readiness preparation: 2 to 4 months.
- the C3PAO must post compliance results into the CMMC instantiation of eMASS within 180 days of the CMMC Status Date
- Until November 9, 2028, in solicitations and contracts, task orders, or delivery orders
- Certificates of CMMC Status FINAL: 2,362 +12%
- it doesn't have a plan for the private sector not having enough certified assessors to meet needs
- As of December 2025, The Cyber AB had authorized 92 C3PAOs, according to DOD officials.
- A Level 2 engagement typically requires a team of two to three CCAs and runs two to six weeks of active work.
- KLC Consulting is already booking Authorized C3PAO Assessment Services well into 2027.
- As of October 2, it is not posted on the DoW CIO CMMC page
- No date has been published.
- A CMMC Status of Final Level 2 (C3PAO) for information systems within the Level 3 CMMC Assessment Scope is a prerequisite
- attach the CMMC Status of Final Level 2 (C3PAO) Certificate issued by the C3PAO
Pharmaceutical
The five gates, in this sector's words
- 1GxP determination and intended use
Each computerised system is determined GxP or not and its intended use is written; the GxP data risk assessment sets the controls the validation will prove.
Decidesthe system owner and process owner; the quality unit approves - 2Validation plan approved
The validation plan, the user and functional requirements and the risk-based test strategy are approved before testing begins.
Decidesthe quality unit - 3Suppliers and infrastructure qualified
Cloud and service providers are assessed as suppliers and the IT infrastructure is qualified; an ISO/IEC 27001 certificate or a SOC 2 Type 2 report answers the supplier assessment where the company chooses one.
Decidesthe system owner with the quality unit; the supplier's certification body or auditor - 4Validation report approved; system released
The validation report is approved and the system released for GxP use; in the EU the Qualified Person certifies batches on its records; the inspector reads the validated state.
Decidesthe quality unit; the Qualified Person (EU) - 5Periodic review and change control
The validated state is kept by change control and periodic review under the quality system; a change in intended use reopens the validation.
Decidesthe system owner under the quality unit
How long authorization usually takes
Jumpstart packages here
32 apply in full 32 in part · of 64
Sources, read 2026-10-13 · links checked 2026-10-15
- 21 CFR Part 11, electronic records and signatures
- EU GMP Annex 11, computerised systems
- GAMP 5 second edition, the validation approach
- FDA's computer software assurance guidance (2026-02-03; a device guidance, persuasive for drug manufacturers)
- describes a risk-based approach to establish confidence in the automation used for production or quality management systems
- updated to reflect the increased importance of information technology (IT) service providers including cloud service providers
- Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
- It's not uncommon for validation activities to stretch across four months or longer for the implementation of a single computer system
- Computer system validation can often take months to complete.
- ISO/IEC 27006-1 specifies the additional requirements for bodies that audit and certify information security management systems (ISMS) in accordance with ISO/IEC 27001.
- It is unlikely that a surveillance/recertification audit will take less than one (1) audit day.
- Your ISO 27001 certificate is valid for three years after the issue date as long as the surveillance requirements are met.
- The Stage 1 audit, also known as the documentation review, usually takes 1-2 days.
- ISO 27001 certification takes 6 to 10 months for most companies, with a realistic range of 3 to 12
- Typically held within the months soon after your stage one
- A SOC 2 Type 2 report covers a period of time, generally 6, 9, or 12 months, with 12-month reports being the most common.
- service organization's system and controls perform over a period of time (typically 3-12 months)
- these tool vendors may promise compliance (a term never used in SOC 2 examinations) in mere weeks — or even just hours
- The AICPA promulgates the professional standards for SOC engagements
Legal and e-discovery
The five gates, in this sector's words
- 1Client and matter data mapped
Every store and path holding client or matter data is mapped: document management, review and hosting platforms, processing stores, backups, collections; each client's guidelines and each matter's protective order set its handling.
Decidesthe CISO; the general counsel or risk committee accepts; the court for matter handling - 2Security package assembled
The firm's or provider's security package is assembled: policies, the ISO/IEC 27001 scope or the SOC 2 system description, questionnaire answers, a penetration test summary.
Decidesthe firm's or provider's CISO - 3Certification or attestation held
ISO/IEC 27001 certification or a SOC 2 Type 2 report is held where the firm or provider chooses it; the duties under ABA Formal Opinions 477R and 498 apply regardless.
Decidesthe certification body or the CPA firm; the firm's risk committee accepts - 4Client acceptance and matter orders
Each client accepts the firm or provider after reviewing its security package; for a matter, the court enters the ESI protocol, the protective order and the FRE 502(d) order.
Decidesthe client's security or vendor-risk team; the court - 5Surveillance, renewals and client audits
Annual surveillance for ISO/IEC 27001, the next Type 2 period for SOC 2, client audits on their cadence and matter-close destruction records keep the standing current.
Decidesthe certification body or auditor; the clients; the CISO
How long authorization usually takes
Jumpstart packages here
27 apply in full 37 in part · of 64
Sources, read 2026-10-13 · links checked 2026-10-15
- ABA Formal Opinion 477R, the duty of care for client data
- FRCP 26, the discovery rule matter protocols rest on
- ISO/IEC 27001, the certification firms choose
- the Sedona Conference commentary on matter handling
- ISO/IEC 27006-1 specifies the additional requirements for bodies that audit and certify information security management systems (ISMS) in accordance with ISO/IEC 27001.
- It is unlikely that a surveillance/recertification audit will take less than one (1) audit day.
- Your ISO 27001 certificate is valid for three years after the issue date as long as the surveillance requirements are met.
- The Stage 1 audit, also known as the documentation review, usually takes 1-2 days.
- ISO 27001 certification takes 6 to 10 months for most companies, with a realistic range of 3 to 12
- Typically held within the months soon after your stage one
- A SOC 2 Type 2 report covers a period of time, generally 6, 9, or 12 months, with 12-month reports being the most common.
- service organization's system and controls perform over a period of time (typically 3-12 months)
- these tool vendors may promise compliance (a term never used in SOC 2 examinations) in mere weeks — or even just hours
- The AICPA promulgates the professional standards for SOC engagements
- a lawyer may be required to take special security precautions to protect against the inadvertent or unauthorized disclosure of client information
- lawyers must make reasonable efforts to prevent inadvertent or unauthorized disclosures of information relating to the representation
- a quarter of law firms were subject to audits in the past year, up from 16% in 2016
- 200-page security questions and onsite audits are the norm to be eligible for instruction
Electric and water utilities
The five gates, in this sector's words
- 1BES Cyber Systems categorized; water assets assessed
Electric: BES Cyber Systems identified and categorized by impact under CIP-002, and the BES Cyber System Information that may live in a third-party or cloud store identified under CIP-011; water: the risk and resilience assessment names the assets.
Decideselectric: the CIP Senior Manager approves the identifications; water: utility management - 2Policies approved; plan certified
Electric: the cyber security policies approved by the CIP Senior Manager under CIP-003, with the information protection and access management programs documented; water: the emergency response plan certified to EPA within six months of the assessment.
Decidesthe CIP Senior Manager; utility management certifying to EPA - 3BES Cyber System Information in the cloud under the programs
Electric: BES Cyber System Information is stored with a third party or in cloud only under the CIP-004 and CIP-011 programs, with encryption and key-management evidence the entity controls; the BES Cyber Systems themselves stay on premises under today's standards; water: the protection approach the assessment chose.
Decidesthe CIP Senior Manager or delegate - 4Compliance shown at audit; certification on file
Electric: compliance with the CIP standards shown at the Regional Entity's compliance audit through the RSAWs and evidence, with self-reports and mitigation plans for what fell short; water: the certification to EPA on file.
Decidesthe Regional Entity determines findings; the CIP Senior Manager owns the response; utility management certifies - 5Audit cycle, self-logging and the five-year review
Electric: the audit cycle, quarterly self-log reviews, the 15-month verification reviews and the implementation plans for new standards (the virtualization set enforceable 1 July 2028; CIP-015); water: the five-year review of the assessment and the plan.
Decidesthe CIP Senior Manager; utility management
How long authorization usually takes
Jumpstart packages here
27 apply in full 37 in part · of 64
Sources, read 2026-10-13 · links checked 2026-10-15
- the NERC CIP standards in force
- NERC Rules of Procedure Appendix 4C, self-reports and mitigation plans
- 42 U.S.C. 300i-2, the AWIA assessment and plan duty
- the Compliance Audit will be performed at least once every three years.
- Every 1-3 years Compliance Audit (on/off-site)
- Responsible Entity identifies its first high impact or medium impact BES 24 months
- calendar quarter that is 24 months after the effective date of the applicable governmental
- CIP-002-8 (supersedes CIP-002-7) 7/1/2028
- first day of the first calendar quarter that is thirty-six (36) months after the effective date
- This action is effective September 2, 2025.
- twelve (12) months after the effective date of CIP-015-1
- no later than twelve (12) months and twenty-four (24) months, respectively, after the effective date of Reliability Standard CIP-015-2
- CIP-015-1 Cyber Security – Internal Network Security Monitoring Oct. 1, 2028
- On average, WECC processes self-logs 60% faster than self-reports.
- ERP certifications are due six months from the date of the RRA certification.
Read again every week.
Standards move, programs are renamed, guidance is withdrawn. Every source on this page, and the rest the studio relies on (686 in all), is checked by a weekly hygiene routine: links that moved are followed, and standards, programs and vendor methods are checked for new revisions, drafts, renames and withdrawals. A change that would alter what a gate means, a lead time or a requirement is reviewed and recorded before the road changes; nothing changes silently. Each sector shows when its sources were read and when its links were last checked; the last full check ran on 2026-10-15.
Research, not a ruling.
These readings are the practice's research, dated and sourced. They are not legal advice and not a statement that any system is authorized, certified or compliant: the organization's own assessor, auditor, regulator or quality unit decides. Lead times are typical ranges from public sources and practice experience, not commitments.
Start a conversation →