# The Cost of Going It Alone: What a Bespoke Cloud Environment Costs a Federal Program

> A program that opens its own cloud accounts instead of onboarding to the enterprise platform pays for engineering, a full authorization, and months of waiting. An illustrative three-year comparison puts the difference at $1.01M, before counting the six months it arrives later.

- Source: https://avalontechservices.com/news/the-cost-of-going-it-alone-what-a-bespoke-cloud-environment-costs-a-federal-program
- Published: 2026-10-21
- Author: [Brandon Ireland](https://avalontechservices.com/author/brandon-ireland)
- Category: Cloud & IT Infrastructure Services
- Topic: Cloud & IT Infrastructure Services
- Publisher: Avalon Technology Services

## Key Takeaways

- Opening a program's own cloud accounts looks fast but rarely is, because the program re-engineers, re-authorizes, and re-staffs what the platform already built.
- In the illustration, onboarding to the enterprise platform costs $1.23M over three years against $2.24M for a bespoke build, about $1.01M less.
- Authorization work is the largest gap, dropping from $350K to $150K, but only if inheritance is documented control by control.
- The onboarding path reaches an authorization-ready environment in about three months instead of nine, worth another $720K at $120K a month.
- Onboarding stays cheaper in every sensitivity case, unless no shared environment supports the program's impact level or mission.

When the enterprise cloud's onboarding queue looks slow, opening the program's own cloud accounts looks fast. It rarely is, and it is almost never cheaper. The program pays to engineer an environment the platform already built, carries a full authorization with nothing inherited, and staffs operations the platform would have shared.

Avalon built an illustrative comparison for one representative unclassified program to put numbers on that choice. It is a planning illustration, not a quote and not a result from any agency. Cloud consumption is the same on both paths, so it is left out.

## Two Paths, Three Years

| Cost line | Build your own | Onboard to the enterprise platform |
| --- | --- | --- |
| One-time engineering and setup | $420K | $165K (fixed-fee onboarding) |
| One-time authorization work | $350K (no inherited controls) | $150K (program-owned controls only) |
| Annual operations staff | $330K (2 FTE) | $165K (1 FTE) |
| Annual continuous monitoring | $120K | $50K |
| Annual contract or platform fees | $40K | $90K |
| Year 1 total | $1.26M | $620K |
| Three-year total | $2.24M | $1.23M |

Onboarding costs $1.01M less over three years. Discounted at 1.1%, the [three-year real rate in OMB Circular A-94 Appendix C for 2026](https://www.whitehouse.gov/wp-content/uploads/2026/03/CircularA-94Appendix-C.pdf), that is $999K in present value. Most of the gap lands in Year 1, where the difference is $640K.

The platform is not free. Its $90K annual service fee is more than the $40K a program spends administering its own cloud contract. The savings come from everything the program no longer has to build, authorize, and staff.

## Inheritance Is the Largest Line

Authorization work is where the two paths split hardest. A bespoke environment has no common control provider, so every control in the baseline is the program's to implement, document, and assess. On a shared platform, physical security and much of the infrastructure layer are inherited outright, and many more controls are shared.

That is why the program-owned authorization work drops from $350K to $150K in the model, and continuous monitoring drops from $120K to $50K a year. Those savings only exist if the inheritance is [documented control by control](https://avalontechservices.com/capabilities/digital-transformation/cloud-and-it-infrastructure-services/gov-shared-cloud-services). An inherited control with no evidence behind it reads as unmet at assessment, and the savings disappear into rework.

## Time Is the Cost the Totals Leave Out

The build path reaches a usable environment ready for authorization in about nine months. The onboarding path gets there in about three.

Program staff and contractors do not stop billing while they wait. At $120K a month in time spent waiting or reworking, six months sooner is worth another $720K. That figure is not in the totals above. Add it, and the full difference passes $1.7M for a single program.

Queue time is the variable a program office controls least. The model's sensitivity case adds three months to the platform queue. The time advantage halves to three months ($360K), while the three-year cost difference stays at $1.01M.

## Where the Case Narrows

Each scenario changes one assumption and holds the rest:

| Scenario | Year 1 difference | 3-year difference |
| --- | --- | --- |
| Base case | $640K | $1.01M |
| Platform service fee doubles to $180K a year | $550K | $740K |
| Weaker inheritance (program-owned work $250K; monitoring $90K a year) | $500K | $790K |
| Building your own costs 30% less | $409K | $779K |

Onboarding stays cheaper in every case. What moves the answer most is how much the platform actually lets the program inherit and what it charges tenants. Both vary by platform, which is why they belong in the platform selection, not in an assumption.

There is one case the comparison does not cover. When no shared environment supports the program's impact level or mission, a bespoke environment is the right answer, and the analysis should say so plainly.

## The Duplicate Accounts Problem

Programs that bypass the enterprise platform often pay a second time. Accounts opened outside the enterprise environment tend to surface later in an IG finding or a cost review. By then, the program is defending the duplication and funding a migration it could have avoided. The same pattern shows up in [unreviewed cloud infrastructure found during assessments](https://avalontechservices.com/news/what-unreviewed-cloud-infrastructure-costs-you-in-a-cmmc-assessment), where accounts nobody governs become findings nobody budgeted for.

Spend billed through a platform with no tagging standard creates a quieter version of the same problem. The program cannot see its own consumption, so it cannot defend or reduce it. [Read-only forensic review of cloud spend](https://avalontechservices.com/news/read-only-forensic-auditing-of-govcon-cloud-environments-architecture-and-execution) is the fix after the fact. A tag dictionary applied at onboarding is the fix before.

## Credits Help the Consumption Bill, Not the Onboarding

GSA's OneGov agreement with AWS offers [up to $1 billion in incentive credits across federal civilian agencies through December 31, 2028](https://www.gsa.gov/about-us/newsroom/news-releases/gsa-announces-onegov-agreement-with-aws-08072025). Credits like these lower consumption and cover provider-delivered support. They generally do not pay for independent, tenant-side onboarding work, so budget that line separately.

The timing works in the program's favor. Onboarding existing systems is usually funded with one-year O&M money, and a fixed-fee sprint with defined deliverables is quick to award in the fourth-quarter obligation window.

Avalon's Gov-Shared Cloud Services engagement starts with a fixed-fee shared cloud fit assessment, priced from $25K to $75K. It scores the candidate platforms against your program's data and impact level, prices both paths with your own numbers, and sets a dated onboarding plan before any tenant work begins.