Authorization Architect · Decision Matrix
Book 1 · Ch 8 · Security, Authority, and Trust

ATO Comparison: 20x vs Moderate vs IL2/IL4/IL5 vs SOC 2

Five authorization pathways mapped across cost, timeline, sponsor requirements, control counts, ConMon cadence, buyer acceptance, and NorthAI fit. A decision framework, not a checklist.

1.2 · Authorization Architect · artifact id: ato-comparison-v0.html · 2026-05-28 · v0
From Shrink-Wrap It, applied to NorthAI · Ch 8 · Security, Authority, and Trust
The first agency took nine months. The second agency took six weeks because of reciprocity.
Ch 8 frames authorization as trust infrastructure: the first authorization is the capital investment, every subsequent agency adoption is the return. NorthAI's sequencing decision (20x now, Moderate conditional, IL2 sponsor-dependent) determines when the reciprocity flywheel starts. This artifact maps all five pathways so that choice is grounded in real numbers, not estimates.

Five-path authorization matrix

All cost and timeline data drawn from FedRAMP Phase 1-2 pilot reports, Paramify, Secureframe, and Schellman published guidance (2026). DoD IL figures drawn from Schellman IL4/IL5 guide, StackArmor IL overview, and Second Front comparative analysis.

Path Cost band (low / mid / high) Time to ATO Sponsor required Controls count ConMon cadence Buyer acceptance NorthAI fit (1-5)
FedRAMP 20x LI-SaaS $150K / $220K / $300K 6-10 months No (Jan 2026 RFC-0023) 156 (NIST 800-53 Low) Quarterly OAR + KSI every 3-7 days All civilian agencies (GSA Marketplace); DoD non-IL4+ low-risk 5 / 5
FedRAMP Moderate $500K / $750K / $1.5M 12-18 months No (sponsorless as of Jan 2026) 323 (NIST 800-53 Moderate) Quarterly + annual 3PAO assessment All civilian agencies; DoD IL2 baseline (with overlay) 4 / 5
(conditional: only if product handles CUI)
DoD CC SRG IL2 $300K / $500K / $700K
(incremental on FedRAMP Low baseline)
6-12 months
(from FedRAMP Low baseline)
Yes (Mission Owner + CACO) 156 base + IL2 overlay (~10-20 additional) Quarterly POA&M + annual C3PAO assessment DoD COs (non-classified); CACO approval binding; interagency requires separate auth 2 / 5
(conditional: requires DoD sponsor)
DoD CC SRG IL4/IL5 IL4: $750K-$2M
IL5: $1M-$3M+
IL4: 12-24 months
IL5: 18-30+ months
Yes (2-star program office or classified sponsor) IL4: 323+30-50 overlay
IL5: 410+50-80 overlay
Quarterly POA&M + annual C3PAO + Mission Owner quarterly briefing DoD mission-critical / classified ops; IC possible with co-authorization IL4: 2 / 5
IL5: 1 / 5
SOC 2 Type II $30K / $50K / $70K initial
$20K-$40K annual renewal
4-8 months (first report)
2-3 months (annual renewal)
No ~75-100 (TSC, indirect NIST mapping) Annual re-audit + continuous evidence collection Commercial buyers; non-binding "quick check" for some civilian CIOs; NOT a GSA Marketplace credential 1 / 5
(stepping stone only, not standalone federal credential)

Per-path narratives

FedRAMP 20x LI-SaaS: the marketplace gateway

This is the right path for NorthAI in 2026. The cost range ($150K to $300K) is calibrated against Phase 1 and Phase 2 pilot data from Secureframe, Paramify, and Meridian. The realistic midpoint for a pre-Series A analytics product with internal engineering resources is $200K to $250K, assuming the team can own documentation and remediation work rather than outsourcing it entirely. The 156-control scope is smaller than it sounds: OSCAL-native GRC tooling converts most policy documents to machine-readable format automatically, reducing the documentation burden that made prior FedRAMP assessments expensive. The sponsor-elimination change (January 2026) removes the historically hardest step. Phase 3 of the program, which opens wide-scale agency adoption, begins Q3-Q4 2026. NorthAI should target authorization by October 2026 to enter the Marketplace before Phase 3 scales demand.

FedRAMP Moderate: the CUI gate

Moderate is not the right first path unless the analytics product handles Controlled Unclassified Information. The cost jump from 20x LI to Moderate is real: Phase 2 pilot data shows $500K to $1.5M end-to-end, with mid-range estimates of $750K to $900K for a focused SaaS product. The documentation burden is substantial (800 to 1,200 page System Security Plan typical). If NorthAI's product scope expands to CUI handling, the Moderate track opens in Year 2 from the 20x LI baseline, with approximately 85% of the 20x controls reusable, reducing incremental effort. Pursuing Moderate before product-market fit on the 20x path is premature capital deployment.

DoD CC SRG IL2: the defense entry point

IL2 is the lowest-cost entry to DoD contracting, but it requires a Mission Owner sponsor and CACO approval that NorthAI does not currently have. The incremental cost from a FedRAMP Low baseline to IL2 authorization is $300K to $700K, and the timeline is 6 to 12 months after the FedRAMP Low baseline is established. NorthAI's 5.5-year history under OSI&A is a signal, but a signal is not a sponsor commitment. If NorthAI can confirm an active DoD Mission Owner relationship (ODE, AFRL, or OUSD R&E), the IL2 track is worth opening in Year 2 to Year 3 in parallel with the FedRAMP 20x authorization. Do not start IL2 documentation without a named sponsor. The documentation effort without a sponsor creates ATO debt that does not convert to authorization.

DoD CC SRG IL4 and IL5: deferred

IL4 and IL5 are strategic options, not tactical moves. IL4 requires a 2-star program office or equivalent as sponsor, $750K to $2M in authorization cost, and 12 to 24 months of timeline. IL5 requires a classified sponsor and $1M to $3M+. Neither is compatible with a pre-Series A capital structure. The 5.5-year OUSD R&E history is directionally relevant but does not constitute a named classified program relationship. Exclude both from the Year 1 to Year 2 strategy. Revisit IL4 only if a specific DoD program office confirms a classified use case and offers sponsorship in writing.

SOC 2 Type II: the commercial credibility signal

SOC 2 Type II is not a federal authorization. It does not earn a GSA Marketplace listing. It does not satisfy FISMA compliance. What it does: provides a commercial credibility signal for any non-federal or interagency pilot, costs $30K to $70K for the initial audit, and shares approximately 30% to 40% of evidence with a FedRAMP 20x LI preparation (access controls, audit logs, incident response documentation). If NorthAI pursues SOC 2 concurrently with FedRAMP 20x prep, the overlap accelerates the FedRAMP timeline by approximately 2 to 3 months. The incremental cost is low enough that SOC 2 is worth adding as a parallel track if any commercial or interagency opportunity emerges. It is not worth pursuing as a standalone federal credential.

FedRAMP 20x LI-SaaS and SOC 2 Type II: control overlap cross-walk

Approximately 30% to 40% of SOC 2 Type II evidence (documentation, audit trails, baseline configurations) is reusable for FedRAMP 20x Low preparation. The overlap is structural, not incidental: both frameworks require access controls, audit accountability, incident response, and risk assessment. The differences are in rigor (FedRAMP mandates FIPS 140-2, federal agency notification timelines, tamper-proof logging immutability that SOC 2 does not require) and in governance (FedRAMP uses a government-accredited 3PAO; SOC 2 uses an AICPA-licensed CPA firm).

Control category FedRAMP 20x LI controls SOC 2 TSC mapping Overlap % Evidence reusable? Key gap (FedRAMP requires more)
Access Control (AC) 24 controls CC6 (Logical access) ~70% Yes (with NIST 800-53 detail) MFA mandate; role-based access prescriptive requirements
Audit & Accountability (AU) 12 controls A&A (Auth/Account) ~60% Partial Centralized logging; tamper-protection; immutability requirement
Identification & Authentication (IA) 8 controls CC6 (User identity) ~75% Yes Password policy rigor; PIV/CAC compatibility for federal users
System & Communications Protection (SC) 14 controls CC6 (Encryption), CT (Change tracking) ~50% Partial FIPS 140-2 algorithm mandate; TLS 1.2+ enforced; no CDN-only deployment
Configuration Management (CM) 6 controls CT (Change tracking) ~65% Partial SCAP scanning cadence; baseline deviation tracking
Contingency Planning (CP) 8 controls A&A (Availability) ~55% Partial RTO/RPO timelines required; annual backup testing documented
Incident Response (IR) 6 controls A&A (Incident response) ~70% Yes Federal agency notification timeline: 72 hours mandatory (SOC 2 does not specify)
Risk Assessment (RA) 3 controls CC1 (Risk management) ~80% Yes NIST RMF alignment required; federal risk vocabulary (impact levels)

Summary: Running SOC 2 Type II in parallel with FedRAMP 20x prep reduces the FedRAMP timeline by approximately 2 to 3 months by front-loading evidence collection. Estimated incremental cost of adding SOC 2 to an active FedRAMP 20x track: $20K to $40K (the 3PAO overlap reduces the marginal SOC 2 audit burden).

Sequenced recommendation: 20x Year 1, Moderate conditional Year 2, IL2 sponsor-dependent Year 3

Year 1 (2026) · Primary path

FedRAMP 20x LI-SaaS authorization. Start immediately (May 2026). Target authorization by October to November 2026 (6 to 7 months wall-clock with tight execution). Budget: $200K to $250K. Outcome: GSA Marketplace listing, civilian agency direct procurement, open federal sales motion. Enter Phase 3 as an authorized vendor, not a late entrant.

SOC 2 Type II (optional parallel). Engage concurrently with FedRAMP 20x prep. Budget: $30K to $50K incremental. Target first report November 2026 to May 2027. Outcome: commercial credibility for any interagency or non-federal opportunity. Not critical for federal sales but low-cost insurance.

Year 2 (2027) · Conditional path

FedRAMP Moderate (conditional on CUI scope confirmation). Open this track only if: (a) NorthAI's analytics product is confirmed to handle CUI, or (b) federal agencies specifically request Moderate-level capability in procurement conversations. Timeline: start Q1 2027 (after 20x LI proves market traction); target authorization Q2 to Q3 2027 (12 to 18 months). Budget: $750K to $900K. Gate: product scope decision must come before authorization spend.

Year 3 (2027-2028) · Sponsor-dependent path

DoD CC SRG IL2 (conditional on named Mission Owner sponsor). Open this track only if NorthAI confirms a DoD Mission Owner sponsor (ODE, AFRL, OUSD R&E) in writing. Timeline: start Q2 2027 (after sponsor recruitment); target authorization Q4 2027 to Q1 2028. Budget: $300K to $500K incremental on FedRAMP Low baseline. Gate: named sponsor required before documentation begins. IL4 and IL5 deferred unless a named classified program explicitly requests authorization.

Open questions

  1. CUI scope confirmation. Does the current NorthAI product process CUI? This single gate determines whether Year 2 Moderate track is a conditional or a near-term priority. Confirm with ISSO or legal counsel before Year 1 authorization closes.
  2. DoD sponsor inventory. Does NorthAI have an active DoD Mission Owner relationship from the 2018-2023 OUSD R&E engagement? If yes, document it now. A named sponsor contact accelerates IL2 track opening in Year 3 without requiring new relationship-building from scratch.
  3. FedRAMP Phase 3 timing. GSA has indicated Q3 to Q4 2026 for wide-scale Phase 3 adoption. If Phase 3 slips, does the Marketplace discovery mechanic still function? Current evidence from post-April 27 2026 authorizations suggests yes: the Marketplace is live and pulling without Phase 3 formal launch. Monitor FedRAMP program office announcements.
  4. ConMon tooling selection. Secureframe and Paramify participated in Phase 1 and Phase 2 respectively. Both publish cost and timeline data consistent with the ranges in this artifact. Confirm tooling choice before 3PAO engagement to avoid mid-stream migration.
  5. Commercial-track SOC 2 decision. Is there a commercial customer segment (non-federal analytics buyers, international, or interagency) that would accelerate with a SOC 2 credential? If yes, run SOC 2 in parallel with FedRAMP 20x prep. If NorthAI is purely defense-focused at launch, defer SOC 2 to Year 2.