By The ATO Delay Tax: A Break-Even Test for RMF Integration
Every month a replacement system waits for authorization, the agency pays to keep the old one running. An illustrative break-even test for one Moderate system shows what RMF Integration costs, how much delay it has to remove to pay for itself, and when it does not pay at all.
A replacement system that is built but not authorized is the most expensive kind of idle. The agency keeps paying to run the legacy system it was meant to retire, the new system's hosting and support contracts are already obligated, and the mission waits. Industry reporting puts a traditional authorization at 12 to 18 months (opens in a new tab), and much of that time goes to work a contractor can influence: package quality, stale evidence, and rework after assessment.
The question for a CFO or COO is narrow. What does it cost to remove that controllable delay, and how many months does it have to remove before the spend pays for itself?
What Nobody Can Promise
Start with the boundary. No vendor controls the assessment schedule or the Authorizing Official's decision, and any proposal that promises a fixed percentage cut in authorization time should be discounted to zero. The honest claim is smaller and more useful: an engagement can remove the delays that come from how the RMF work is done. Implementation statements that do not match configuration, evidence gathered by hand the week before an assessment, and inherited controls the AO will not accept without a responsibility matrix are all fixable, and an ATO roadmap from kickoff to the AO's decision (opens in a new tab) shows where each fix belongs.
So the model below does not assume any percentage reduction. It asks what the removed months are worth.
The Illustration
The figures are a planning illustration for one representative system, not a quote and not a result from any engagement. An agency is replacing a legacy system with a new system at the Moderate baseline.
| Input | Value |
|---|---|
| Readiness assessment (posture review and roadmap) | $25K |
| Integration (baseline, evidence automation, monitoring, handoff) | $160K |
| Total engagement | $185K, firm fixed price |
| Cost of each month the legacy system keeps running | $50K |
| Manual evidence and package labor today | 1,600 hours a year at $150 an hour |
| Automated evidence live | Month 7 |
At $50K a month, removing about 3.7 months of delay covers the entire $185K engagement before any labor savings are counted.
The Base Case and the Weak Cases
Two things drive the result: how many months of controllable delay the engagement removes, and how much of the manual evidence labor moves to pipeline gates and monitoring feeds.
| Scenario (three years) | Net of engagement cost | Payback |
|---|---|---|
| Base case: 40% of labor automated, 2 months of delay removed | $155K | Month 17 |
| 40% of labor, 4 months removed | $255K | Month 8 |
| 40% of labor, no delay removed | $55K | Month 30 |
| 20% of labor, 2 months removed | $35K | Month 28 |
| 20% of labor, no delay removed | -$65K | Not within 3 years |
Discounted at the 1.1% three-year real rate in OMB Circular A-94 Appendix C for 2026 (opens in a new tab), the base case is worth $150K over three years.
Read the table from the bottom. When there is little manual labor to automate and no delay to remove, the integration loses money, and the right purchase is the readiness assessment alone. Delay is the bigger lever, but it is a one-time gain. The labor savings are smaller and slower; they keep arriving every year the agency runs the automated evidence, long after the engagement ends.
Why the Evidence Line Keeps Paying
Manual evidence is a recurring cost most budgets carry without naming it. ISSOs and engineers assemble screenshots and scan exports for each assessment, each data call and each reauthorization. The same work repeats because the evidence ages from the day it is collected.
The policy direction is to stop paying for it that way. OMB Circular A-130 (opens in a new tab) treats security as a continuous, risk-based program rather than a periodic exercise. DoD went further in September 2025, announcing a Cybersecurity Risk Management Construct (opens in a new tab) built on automation, continuous monitoring and reciprocity as the successor to RMF. Programs that keep producing evidence by hand will be paying for a process their oversight is moving away from.
What the Money Buys, and What It Does Not
The $160K integration is priced firm fixed price against named systems, with bounded deliverables: a tailored control baseline, an inheritance matrix, implementation statements matched to configuration, pipeline control gates, compliance-as-code profiles, a continuous monitoring strategy, and runbooks so agency staff run the process afterward. A single Moderate system typically takes four to eight months, and the market range for that scope runs from $75K to $250K.
Three costs stay outside it. The independent assessment is performed by a separate assessor. Remediation beyond a capped number of hours goes to a change order, where it can be run as its own engineered remediation cycle (opens in a new tab). Ongoing ISSO staffing is a separate arrangement.
Fitting It Into This Year's Budget
The readiness assessment runs $15K to $35K, well under the simplified acquisition threshold of $350,000 (opens in a new tab), so it can be bought quickly as an open-market purchase with fourth-quarter or first-quarter O&M funds. Its output is the number this illustration can only assume: the agency's own parallel-run cost, its own evidence hours, and a view of how much of its authorization delay is controllable at all.
Avalon's RMF Integration service starts with that fixed-price readiness assessment, delivered in three to seven weeks. It replaces every assumption above with your system's figures and tells you whether a full integration is worth buying before you commit to one.
