By Paying for the Same Cloud Foundation Eight Times: The Landing Zone Break-Even
When every program builds its own cloud environment, the agency pays for the same foundation again and again, and waits for it every time. An illustrative three-year model shows when one engineered landing zone pays off, and when it does not.
Most agencies budget for cloud as consumption: compute, storage and licenses, often at a discount. GSA's OneGov agreements have pushed those prices down further, including up to $1 billion in AWS incentive credits through December 31, 2028 (opens in a new tab). What rarely gets its own budget line is the engineering underneath: the accounts, network, identity, logging and guardrails every system needs before it can run.
So each program builds its own. One workload at a time, the agency pays for the same foundation again, and every program waits for it. For a CFO or COO, the question is whether building that foundation once is worth it, and how many programs it takes before it is.
The Two Paths
The figures below are a planning illustration for one agency cloud program office, not a quote and not a result from any engagement. They count engineering labor only. Cloud consumption is excluded because the agency pays it under either path.
The office expects eight new programs over three years.
| Input | Bespoke environment per program | One landing zone, vended environments |
|---|---|---|
| Up-front engineering | About $140K per program | $80K blueprint plus $420K build |
| Rework when the assessor finds gaps | $35K per program | Built in, with evidence |
| Lead time to an accepted environment | 24 weeks | 22 weeks for the build, then 3 weeks per program |
| Per-program onboarding | None | $25K |
| Annual upkeep | $30K per environment | $8K per program plus $90K for the platform |
What It Costs Over Three Years
| Scenario | Bespoke | Landing zone | Difference |
|---|---|---|---|
| Base case: 8 programs | $1.70M | $1.03M | $664K less |
| Build at the top of the price band ($600K) | $1.70M | $1.21M | $484K less |
| Slow agency decisions (build 10 weeks late) | $1.70M | $1.09M | $605K less |
| Only 3 programs | $663K | $850K | $187K more |
In the base case, the landing zone path starts costing less at the fifth program. A build at the top of the band moves that to the sixth. Discounting at the 2026 OMB Circular A-94 three-year real rate of 1.1% changes no total by more than about 2%, so the comparison holds in present-value terms.
The last row matters as much as the first. An office with only a few programs coming does not need a full landing zone. It needs a design-only blueprint, applied program by program, and an honest model will tell it so.
Lead Time Is the Bigger Number
The cost gap is real, but the schedule gap is larger. Under the bespoke path, every program waits about 24 weeks for an environment its ISSM will accept. Under the landing zone path, the first program waits for the build, about 25 weeks, and the second about 6. Every program after that waits 3.
If agency decisions slow the build by ten weeks, the first program waits about 35 weeks and the second about 16. The cost advantage barely moves. The agency's own decision speed decides how soon the early programs benefit, which is why the statement of work should carry a decision-turnaround clause.
For a mission program, five months of waiting is five months without the capability it was funded to deliver. That cost never appears in the cloud budget, but the program manager feels all of it.
Where the Waste Shows Up Later
Bespoke environments do not only cost more to build. Each one carries its own logging, network and guardrails, and each drifts on its own schedule. Unmanaged accounts, missing tags and duplicate shared services are exactly what a read-only forensic audit of a cloud environment (opens in a new tab) later finds and recovers. Architecture prevents the waste; the audit finds what architecture missed. The two work best together.
Fitting It Into This Year's Money
The blueprint is the natural first purchase. A design-only engagement of 6 to 9 weeks is typically priced between $60K and $150K, well under the $350,000 simplified acquisition threshold (opens in a new tab), so it can be bought as an open-market purchase with one-year O&M funds. It produces a target design and a clear answer on whether a full build is worth funding for the agency's program pipeline.
Builds are priced as milestone-based fixed price, so the agency pays for accepted deliverables. Market-norm ranges run $250K to $600K for an unclassified, single-provider landing zone. None of this is ever tied to an authorization outcome, because that decision belongs to the agency's Authorizing Official.
The engineering behind a landing zone built as code (opens in a new tab) explains what the build price buys: guardrails mapped to NIST SP 800-53, environment vending and control-implementation evidence.
The Budget Question to Ask
Before funding the next program's environment, ask how many more are coming in the next three years. If the answer is four or fewer, fund a blueprint and harden each environment against it. If it is five or more, the foundation is cheaper to build once than to keep buying.
Avalon's Cloud Architecture & Engineering service starts with a fixed-price assessment and target-state blueprint, priced under the simplified acquisition threshold. It shows what the agency's environment should look like, what it would take to build, and whether the landing zone pays off for the programs actually in the pipeline.
