By The Reauthorization Clock: What Waiting Costs When Your ATO Expires
An ATO that expires in mid-2027 sets a procurement deadline in 2026. Working backward from the expiration date shows when the work has to start, why a stale package costs about twice as much to fix, and what a readiness review tells a program before it commits.
An Authority to Operate has an expiration date, and most program offices treat it as the deadline. It is not. The real deadline is the date the reauthorization work has to be on contract, and for a typical system that falls nine months or more before the ATO lapses. Miss it, and the choices narrow to a compressed schedule, an extension memo, or a system that has to stop.
The cost side is just as easy to miss. A package that nobody maintained between cycles stops being a reauthorization and becomes a rebuild, and a rebuild costs about twice as much.
Working Back From the Expiration Date
The figures below are a planning illustration for one representative Moderate-baseline system, not a quote and not a result from any engagement. Its ATO expires on June 30, 2027. The schedule uses market-norm phase durations for package preparation, plus two steps the government controls: six to ten weeks to award a fixed-price task, and four to eight weeks for the Authorizing Official to review the package and decide.
| Package condition | Start procurement by | Total lead time |
|---|---|---|
| Rebuild, typical pace | September 20, 2026 | 9.3 months |
| Rebuild, slow pace | May 20, 2026 | 13.3 months |
| Serviceable package, typical pace | December 21, 2026 | 6.3 months |
| Serviceable package, slow pace | September 26, 2026 | 9.1 months |
The spread is the point. The same expiration date produces procurement deadlines seven months apart, and the variable that moves them is the condition of the existing package. A program that does not know which row it is in does not know its deadline.
Why a Stale Package Costs Twice as Much
A serviceable package still describes the system: the boundary is right, the implementation statements match the configuration, and the evidence is recent enough to update rather than recreate. Reauthorizing it takes three to five months and typically prices at 40% to 60% of an initial authorization.
A stale package does not. Turnover in the ISSO role, three years of system changes and an abandoned governance record turn it back into an initial authorization, which takes five to nine months for a Moderate system.
| Scope | Illustrative firm fixed price |
|---|---|
| Readiness review (mock assessment and gap report) | $25K |
| Reauthorization of a serviceable Moderate package | About $88K |
| Rebuild of the same package | About $175K |
The roughly $88K difference is what a package's decay costs when nobody keeps it current. It buys nothing the agency did not already have three years earlier.
What an Extension Memo Really Costs
When the schedule runs out, programs ask the AO for an extension. Some get one. But an extension is a risk decision made with less information, not a free month. Systems running on expired or extended authorizations are a recurring Inspector General finding, and they draw the CISO's office into the program's schedule. It also leaves the program paying operations and support costs on a system whose risk posture nobody has recently confirmed.
The cheaper move is the one that happens earlier: know the package's condition before the procurement deadline passes.
The Readiness Review Is the Decision Tool
A readiness review is the smallest purchase that answers the question the timeline depends on. It runs the package against the NIST SP 800-53A assessment procedures, the same procedures the independent assessor will use, and reports what would fail and why. In three to five weeks the program learns whether it faces a reauthorization or a rebuild, and what each would take.
It also fits the budget calendar. At $15K to $40K, a readiness review sits well under the simplified acquisition threshold of $350,000 (opens in a new tab), so it can be bought quickly as an open-market purchase with one-year O&M money, including in the year-end obligation window when A&A task orders cluster. The ATO compliance roadmap for program offices (opens in a new tab) covers who owns each step once the work is funded.
What the Full Package Price Buys
If the review finds a rebuild, the work is priced firm fixed price with milestones and written acceptance criteria for each artifact. For a Moderate system the market range runs from $100K to $250K. The price covers the categorization, boundary, System Security Plan, plan set, evidence library, mock assessment, assessment support, POA&M and the AO briefing.
It does not cover the independent assessment, which must be performed by someone other than the team that prepared the package, or remediation beyond minor fixes. Most importantly, it does not buy the decision. The AO grants or denies the ATO, and no vendor's fee should depend on that outcome. What the money buys is a package built so that every statement traces to evidence an assessor can verify (opens in a new tab), which is what keeps the assessment, and the schedule, from slipping.
Putting a Date on It
The useful exercise for any program with an ATO expiring in the next 18 months is to write down three dates: the expiration, the procurement deadline for a reauthorization, and the earlier deadline for a rebuild. If the second date is close, the package's condition is the most valuable thing the program does not yet know.
Avalon's ATO Process Facilitation service starts with that fixed-price readiness review. It gives you the mock-assessment result, the gap report and a clear answer on reauthorization versus rebuild, so the procurement deadline is a date on your calendar rather than a surprise.
