Digital TransformationApplication Development & Modernization
By How a fixed-fee automation candidate assessment scores every candidate in one process area, baselines the hours, pre-screens each bot for the ISSO and recommends a licensing path on the platform the agency already owns.
Across government, the people left and the work stayed. Invoices still arrive, personnel actions still need processing, reconciliations still close every month and FOIA requests still queue. The remaining staff carry it, often by copying data from one system into another by hand. Operations and financial management directors know some of that work could be done by software. What they lack is a defensible answer to three questions: which processes, on which platform, and what the security office will need before a bot touches a production system.
Most automation efforts stall on those questions: the first idea gets built against a fragile screen, then waits months at the ISSO's desk because nobody documented the bot's account, credentials or logs.
This paper is for the people who own that backlog: the program, operations or financial management director who funds the work, the ISSO or ISSM who must approve any automation, the CIO or Chief AI Officer who owns the platform, and the COR who buys the work. It describes Avalon Technology Services' Process Automation service, which starts with one engagement:
The illustration later in this paper works through the effort model. Its base case covers twelve candidates across five systems: 328 hours, or $40.2K to $56.3K, with a $48K planning fee, far under the $350,000 simplified acquisition threshold. The assessment measures capacity in hours. It does not convert hours into budget savings, and it does not claim positions can be cut.
Avalon prepares the inputs; the agency approves. Avalon does not issue or confer an Authorization to Operate, does not certify compliance, and does not guarantee the outcome of any security review.
Each phrase below signals an automation candidate; none says which process to start with.
| What the program says | What it usually means |
|---|---|
| "We lost people and the work didn't go anywhere." | Fixed workload, smaller team, and no hiring path in the current budget |
| "My folks spend all day copying things from one system into another." | Swivel-chair work between systems with no integration; the classic automation case |
| "The auditors flagged our manual journal entries." | A manual control is now an audit finding with a corrective action date |
| "The invoice backlog is costing us interest." | Late payments accrue Prompt Payment Act interest, a visible cost of the backlog |
| "One person knows how to do this and she's retiring." | The process documentation lives in one person's head |
| "We tried bots before and they kept breaking." | Screen automation against unstable interfaces with no support path |
Automation inherits the frameworks of the systems and data it touches. The drivers below decide what the assessment checks.
| Driver | What it says | What it means for this engagement |
|---|---|---|
| NIST SP 800-53 Rev. 5 | Account management, least privilege, authentication, audit and change control apply to non-person entities as well as people | Every candidate is pre-screened for the bot accounts, privileges and systems it would need |
| NIST SP 800-37 Rev. 2 | Seven RMF steps, starting with Prepare; changes to an authorized system go through configuration control and security impact analysis | Each automation is a change to an authorized system; the pilot carries its own security impact analysis inputs |
| FedRAMP Consolidated Rules (Jun 25, 2026) | Cloud offerings are "FedRAMP Certified" in classes A through D; certification covers the provider's offering only | A certified automation platform does not approve the agency's automations; each one still passes agency review |
| OMB M-25-21 (April 2025) | Federal AI use governance; replaced M-24-10 | Applies only where an automation uses AI, such as document extraction; rules-based bots are not AI use cases |
| OMB M-26-14 (May 2026) | A risk-based logging model; replaced M-21-31 | The logging specification states what each bot logs and where, to the agency's decisions |
| Prompt Payment Act | Late payments to vendors accrue interest | Invoice backlogs carry a measurable cost; accounts payable is a frequent first process area |
| Section 508 | Accessibility for information and communication technology (the 2017 refresh incorporates WCAG 2.0 AA) | Any approval screen or dashboard a person uses must conform |
| Privacy Act and federal records requirements | PIAs when PII use changes; records retention under NARA rules | The pre-screen flags candidates that would change PII handling or move federal records |
| Microsoft announcements | SharePoint 2013 workflows retired in SharePoint Online on April 2, 2026; InfoPath 2013 end of support on July 14, 2026 | Retired workflows leave manual gaps; the inventory captures them as candidates |
Two notes on funding and scope. The Technology Modernization Fund was extended through fiscal year 2026; agencies should confirm its current status before planning around it, and this service is normally funded from operations budgets. And the assessment does not accept controlled unclassified information: Avalon has no CUI-handling environment, so sample data, screenshots and process documents containing CUI stay inside the agency's boundary.
The assessment covers one process area. It finds every candidate, measures and scores it, and says which to build, which to fix first and which to leave alone. It works in the agency's environment, with the people who do the work, and installs nothing.
| Step | Activities |
|---|---|
| Process inventory | Interviews and observation sessions with the staff who do the work, not only their supervisors; every candidate listed with its systems and inputs |
| Hours baseline | Annual volume, hands-on minutes per item and exception rate for each candidate, from agency counts and observed timings |
| Suitability scoring | Seven criteria scored 1 to 5, with the evidence for each score written down |
| Complexity tiering | Each recommended candidate placed in a simple, medium or complex build tier |
| Security pre-screen | Data sensitivity, systems touched, bot accounts and privileges each candidate would need, and whether AI is involved |
| Licensing path | A recommendation on the platform the agency already owns or can most easily authorize |
Every candidate is scored on volume, frequency, rule clarity, input stability, exception rate, system accessibility and data sensitivity. High-volume work with one-page rules, stable inputs and an API or export scores high; judgment-heavy work scores low. Declining a bad candidate is part of the job: when a process fails the rule-clarity or input-stability screen, the recommendation is to fix the process first, or to route a judgment-heavy process to a separate AI and machine learning assessment.
The assessment records, for every system a candidate touches, whether an API, export or file interface exists. Automations built against those interfaces break far less often than bots that operate a user interface. Screen automation remains an option for legacy systems with no other path, documented as the fallback it is. Where discovery shows that a system needs new APIs, that becomes a backlog item for Avalon's separate Web Services & Microservices service.
| Deliverable | Format |
|---|---|
| Automation Opportunity Assessment: inventory, scores and recommendations | Report (PDF and Word) plus a readout session |
| Prioritized backlog and hours baseline, with complexity tiers | Excel workbook the agency can maintain |
| Security pre-screen per recommended candidate: data, systems, bot accounts, AI use | Worksheet formatted for the ISSO's review |
| Licensing-path recommendation on the agency's existing platform | Short memo in the report |
| Minimal governance note: who may build bots and where they are inventoried | One page in the report |
The assessment stops at the readout, unless the agency buys the optional pilot. Each boundary below is separate Avalon work. Replacing the underlying system is Application Modernization; disposition across a portfolio is IT Modernization. Building an application people use to do work is Low Code / No Code. New APIs belong to Web Services & Microservices; delivery pipelines belong to CI/CD Pipelines and DevSecOps; custom machine learning or AI agents belong to Cloud AI/ML Services. Business process reengineering, license resale and ongoing operations of deployed bots are out of scope.
The pre-screen and any pilot's security package use the agency's control vocabulary. Each control below applies to bot identities as it does to people.
| Control | What the pre-screen and pilot package address |
|---|---|
| AC-2, IA-2, IA-5 | A bot account matrix: every non-person entity, its owner, and how credentials are issued, vaulted and rotated |
| AC-5, AC-6 | Separation of duties and least privilege for each bot account |
| AU-2, AU-3, AU-6 | A logging specification for bot actions the agency can review |
| CM-3, CM-4 | Change control and security impact analysis inputs for each deployment |
| RA-5 | Automation infrastructure kept in vulnerability-scan scope |
| SA-9 | External service considerations when a SaaS automation platform is used |
The accurate way to state the value is narrow. Avalon delivers each automation with a complete security documentation package (non-person-entity account matrix, data flows, logging specification and security impact analysis inputs) formatted for the ISSO's review, and supports the agency through change approval.
| Accurate | Not accurate |
|---|---|
| Documents every bot account, privilege and credential path | The automation is compliant |
| Prepares security impact analysis inputs for the change board | The automation is authorized |
| Runs inside the agency's authorized boundary and tenant | The automation inherits the ATO |
| Measures hours returned against a documented baseline | Hours saved equal budget savings |
| Phase | Timing | What happens |
|---|---|---|
| 0: Kickoff and access | 1–3 weeks | Accounts and environment access, named SMEs, named ISSO contact, dependency log started |
| 1: Discovery and assessment | 2–4 weeks | Interviews, observation, inventory, hours baseline, scoring, pre-screen, readout |
| 2–4: Optional pilot | 8–14 weeks | Process and solution design, build, testing, security review, deployment, two weeks of hypercare |
| 5: Scale waves (separate) | 8–12 weeks each | Three to five automations per wave, each priced by complexity tier |
The assessment is Phases 0 and 1 only, bought as a standalone firm-fixed-price task. Assessment plus one pilot typically runs 10 to 16 weeks end to end. On DoD systems, change control usually adds 25 to 50 percent to the security review and deployment phase.
| Included | Separate work |
|---|---|
| Inventory, scoring and backlog for one process area | Automation across many process areas at once |
| Recommendation to fix a process before automating it | Redesigning the process |
| Licensing-path recommendation | Software licensing or resale |
| Security pre-screen | Writing the SSP or the authorization package |
| One optional pilot, priced separately | Scale waves, a center of excellence or ongoing bot operations |
| Unclassified civilian or DoD environments | Classified, CUI-handling or cleared environments |
An assessment needs an automation lead and an analyst, not a bench. Avalon takes one engagement at a time, works business hours, and works in unclassified environments only. Avalon's founder serves as project manager, process analyst and security pre-screen reviewer, with one named automation lead hired or subcontracted for the engagement. Avalon has no past federal engagements under this service. FAR 15.305 says an offeror without a record of past performance may not be evaluated favorably or unfavorably on that factor; what protects the program is a named team, a fixed price, a bounded scope and a clean exit in which the agency keeps every artifact.
| Requirement | How it is handled |
|---|---|
| Automation lead | Named personnel whose platform certification (for example Microsoft PL-500 or UiPath Certified Professional) matches the agency's platform, listed in the proposal |
| Privileged access on DoD systems | Personnel holding the DoD 8140 qualification the program requires, as a condition of the engagement |
| Civilian access | Public Trust investigation at the tier the agency requires |
| Platform | Work happens in the agency's tenant and tooling with access the agency provisions; Avalon hosts nothing |
| Insurance and contract vehicles | Any coverage the solicitation requires is a condition of award; Avalon does not hold a GSA Schedule or a governmentwide contract today |
| Engagement | Market-norm range | Avalon |
|---|---|---|
| Automation opportunity assessment (directorate-level) | $40K–$90K FFP | Firm fixed price; illustrative $48K for twelve candidates |
| Assessment + one pilot automation in production | $65K–$150K FFP | Anchor in the $65K–$95K band; pilot fixed after the assessment names it |
| Per-automation build (follow-on waves) | Simple $25K–$50K; medium $50K–$90K; complex $90K–$150K+ | Priced per automation by tier, as separate follow-ons |
The assessment sits under the $350,000 simplified acquisition threshold and can be bought as an open-market purchase. Purchases between the $15,000 micro-purchase threshold and the SAT are generally set aside for small business when two or more capable small businesses are expected to compete. Larger programs can subcontract to Avalon through a prime. Avalon does not hold a GSA Schedule or a governmentwide contract today, and it does not resell software or licenses: licensing is agency-procured and Avalon-advised.
Prices are fixed against one named process area with a cap on candidate count and a dated dependency schedule. Every deliverable, and any pilot's design documents and workflow artifacts, is delivered with unlimited rights under FAR 52.227-14 (or the DFARS equivalent for DoD), with no proprietary lock-in. There is no fee tied to hours saved.
The figures below are a planning illustration for one representative unclassified process area. They are not a quote, not a baseline from any agency and not a result from any engagement.
Hours come from annual volume, hands-on minutes per item and the exception rate. Exceptions stay manual and leave automation scope.
| Candidate | Volume x minutes | Hours today | In scope | Score (of 35) | Recommendation |
|---|---|---|---|---|---|
| Vendor invoice intake and matching | 18,000 x 12, 15% exceptions | 3,600 | 3,060 | 28 | Medium tier ($50K–$90K) |
| Case review and eligibility determination | 2,400 x 45, 40% exceptions | 1,800 | 1,080 | 17 | Fix the process or route to AI/ML |
| Monthly reconciliation report assembly | 600 x 30, 5% exceptions | 300 | 285 | 29 | Simple tier ($25K–$50K) |
Together these three candidates consume 5,700 hours a year, of which 4,425 are in automation scope. Only 3,345 of those hours sit in candidates the matrix recommends. Case review has the most hours per item, but its 40 percent exception rate and judgment-heavy rules fail the screen. Invoice intake uses document extraction on varied layouts, which is an AI use and brings M-25-21 governance into the pilot plan; the reconciliation report is a simple, single-system build. The 3,345 hours are capacity the remaining staff can return to mission work, not a budget reduction.
| Role | How hours are built | Base hours |
|---|---|---|
| Automation lead | 84 fixed (kickoff, method, licensing path, report, readout) + 4 per candidate + 4 per system | 152 |
| Process analyst | 44 fixed (inventory and workbook) + 6 per candidate (interviews, observation, timing) | 116 |
| Project manager | 10 a week (dependency log, status, scheduling) | 60 |
| Total | Twelve candidates, five systems, six weeks | 328 |
The lead is priced at the architect band of $160 to $220 an hour. The analyst and the project manager are priced at the analyst band of $90 to $130 an hour, since the market data gives no separate project manager rate.
| Scope | Hours | Rate-band range | Planning fee | Inside $40K–$90K |
|---|---|---|---|---|
| Small (8 candidates): 4 systems, 5 weeks | 274 | $33.9K–$47.5K | $41K | Yes, fee held at or above the floor |
| Base (12 candidates): 5 systems, 6 weeks | 328 | $40.2K–$56.3K | $48K | Yes |
| Large (20 candidates): 8 systems, 7 weeks | 430 | $52.4K–$73.5K | $63K | Yes |
The base case runs 328 hours over six weeks: $40.2K to $56.3K, with a $48K planning fee at the midpoint. A small area with eight candidates runs $33.9K to $47.5K; its low end falls under the $40K market floor, so the fee never follows the low end below the floor. A large area with twenty candidates across eight systems runs $52.4K to $73.5K, still inside the market band. Beyond about twenty candidates the statement of work splits the area.
The backlog prices each recommended automation by tier, which tells the program what a scale wave would cost before it commits. Three simple builds fall between $75K and $150K. A mixed wave of two simple, two medium and one complex automation falls between $240K and $430K, which can cross the simplified acquisition threshold at the top. That is why the assessment caps candidate count and why each wave is priced as its own follow-on.
| Pitfall | How to avoid it |
|---|---|
| "While you're in there" requests during a build | The signed process definition is the scope; anything else is a change order |
| Automation quietly turns into process redesign | Automate the process as documented; redesign is separately scoped work |
| Overselling compliance | Never say the bot is compliant, authorized or inherits the ATO |
| Agency dependencies slip without notice | A dated dependency log reviewed at every status meeting |
| Automating a broken process | Say no in the assessment and recommend the fix first |
| Bot sprawl after a successful pilot | A governance note naming who may build and where bots are inventoried |
| Hours presented as budget savings | Report returned hours as capacity against a documented baseline |
Most agencies already own an automation platform. Manual work persists because nobody has measured which processes are worth automating, documented what the security office needs, or said which candidates should not be automated at all.
The natural first step is the fixed-fee automation candidate assessment: one process area, about six weeks, under the simplified acquisition threshold, ending in a scored backlog, an hours baseline, a security pre-screen the ISSO can read and a licensing path on the platform the agency already owns. To discuss a process area, contact Avalon Technology Services at contact@AvalonTechServices.com.
Robotic process automation (RPA)
Software that operates applications the way a person would, used when no better integration path exists.
Non-person entity (NPE)
An account used by software rather than a person, such as a bot's service account.
Suitability matrix
The seven criteria used to score each automation candidate from 1 to 5.
Hours baseline
Annual volume times hands-on minutes per item, measured before any automation is built.
Exception rate
The share of items that still need a person because they fall outside the rules.
Process Definition Document (PDD)
The signed record of a process's steps, rules and exceptions; it defines the scope of a build.
Security impact analysis
The review of how a change affects a system's security, required before the change board approves it.
Intelligent document processing
Configured extraction of data from forms and documents; an AI use under M-25-21.
All values are planning assumptions for one representative unclassified process area. None is drawn from a specific agency, a real system or a completed engagement.
| Assumption | Value | Basis |
|---|---|---|
| Candidates and systems | 12 candidates across 5 systems (base) | Planning assumption |
| Candidate inputs | Volumes, minutes and exception rates in the illustration | Planning assumption |
| Pass threshold | Score of 24 of 35, and rule clarity and input stability above 2 | Planning assumption |
| Duration | Six weeks including kickoff and readout | Inside KB Phase 0 and Phase 1 ranges |
| Rates | Lead $160–$220; analyst and PM $90–$130 an hour | Market-norm rate bands |
| Price check | Base fee $48K | Inside $40K–$90K; under the SAT |
