RMF software for SBIR companies
Do the unfunded parts first — boundary, categorization, architecture — because they cost nothing but decisions and everything downstream depends on them. Tooling helps after that, and helps most with the parts a small team cannot sustain manually.
A small company wins an SBIR, builds something good, and then discovers that getting it onto a government network requires an authorization. Nobody on the team has done RMF. There is no security staff. The program office wants a package and the timeline assumed the technology was the hard part.
This is an extremely common situation and most RMF content is written for people who are not in it.
Read this before you buy anything
Three things are true and worth accepting early.
RMF is bigger than it looks. A moderate baseline is a few hundred controls, each decomposing into individually testable assertions. It is not a checklist you work through in a fortnight.
Most of it is not technical. Your engineers will find the technical controls familiar. Contingency planning, personnel security, configuration management processes, incident response, awareness training — those are organizational, and a five-person company genuinely may not have them in the form the control expects. That is normal and it is what tailoring and compensating controls exist to address.
Nobody is coming to do it for you. Your government sponsor may be helpful and cannot do the work. A consultant can help enormously and is expensive. In most cases someone on your team becomes the RMF person, and that person needs to be senior enough to make decisions.
The order that works, and what each stage costs
1. Find out what is actually required. Which AO, which baseline, which system of record, which overlays. Ask your program office directly and get it in writing. Programs lose months building toward the wrong requirement, and this question costs an email.
2. Define the boundary. What is inside the authorization and what is not. This is the single most consequential decision you will make and it costs nothing but thought. A boundary drawn too wide pulls in infrastructure you do not control. Too narrow and your interconnections become the problem. Get this wrong and everything downstream is wrong.
3. Categorize. FIPS 199. Information types, impact for confidentiality, integrity and availability, and the system level as the high-water mark. It determines your baseline, so it determines the size of the entire job. Do it deliberately with your sponsor rather than guessing high to be safe — guessing high can double the work.
4. Model the architecture. Boundary, zones, components, connections, data flows, interconnections. As structured facts, not only as a diagram. You will need this for the SSP regardless, and if it exists as data rather than a picture, everything downstream gets cheaper.
5. Then start on controls.
Stages 1 to 4 cost decisions and time, not money. They are also where small companies most often skip ahead, and the skip is expensive.
Where tooling actually helps a small team
Once the foundations exist, the question is what a small team cannot sustain manually. In roughly descending order of value:
Not losing the reasoning. Your one RMF person holds the entire model in their head. If they leave, a company your size may not recover the context. A record where the rationale lives beside the decision is insurance against your largest single risk.
Not re-deciding. The same false positives, every scan cycle. The same tailoring arguments, every assessment. A small team cannot absorb repeated work that a larger team merely resents.
Generating artifacts. Writing an SSP by hand is weeks. Generating one from a record is not, and regenerating it after a change is the difference between maintaining a package and rebuilding it.
Pipeline evidence. If you already run CI with security scanning, that output can become authorization evidence automatically rather than through a quarterly manual exercise. Small teams usually have good pipelines, which makes this cheaper for you than for a larger program.
Knowing what a change affects. You will change the system constantly — you are a small company building a product. Being able to scope the RMF consequence of a change rather than fearing it is what keeps security from becoming the reason you stop improving the thing.
What not to spend money on yet
- An enterprise GRC platform. Sized and priced for a compliance department you do not have. The implementation alone will exceed the value.
- A consultant to do everything. A consultant to advise, review and unblock is money well spent. A consultant who produces a package your team does not understand leaves you with a document you cannot maintain and an authorization you cannot sustain.
- Anything before the boundary is settled. Tooling built on an unclear boundary produces a well-organized version of the wrong system.
The reciprocity question
Ask early, because the answer can change everything: is there an existing authorization you can inherit from?
If your software runs on a platform that already holds an ATO, some controls may be inherited from that platform’s common control provider. That can remove a substantial fraction of your work.
The catch is that inheritance must be recorded properly. An inherited control is not one you implement — it is one someone else carries for you, and your record has to say so. Losing that distinction means asserting local implementation of something you do not do, and an assessor will ask for evidence you never had.
Realistic expectations
Timeline. A first ATO for a small company typically takes six to eighteen months depending on categorization, sponsor engagement and how much foundation work was done before starting. Anyone promising ninety days is describing a different situation than yours.
Cost. Even with good tooling this consumes real engineering time. Budget it as a project, not as overhead absorbed alongside product work.
After. The ATO is not the finish. Continuous monitoring is an ongoing obligation, and the package degrades from the day it is signed unless something maintains it. That is the part small companies are least prepared for and it is where the record earns its keep.