An Albuquerque federal-adjacent SaaS · $90K → $420K MRR.

Pre-engagement state: $90K MRR on a commercial AWS commercial-region deployment, single-tenant, no Controlled Unclassified Information handling boundary, no NIST 800-171 self-attestation on file in the SAM.gov Supplier Performance Risk System (SPRS) score record, no audit trail, no separation-of-duty controls, no SAML SSO. Stack was a typical commercial-SaaS combination: Next.js front end, a Python service tier, Postgres, Stripe, Auth0, vanilla AWS networking inside a single VPC. Nothing wrong with any of those choices on the commercial side, but every one of them was a question mark the moment a defence prime's security team asked, "show us your boundary diagram and your CUI flow-down".

The founder had three structural problems compounding the revenue ceiling. One, defence-prime subcontractor contracts that touch CUI (Controlled Unclassified Information) require the supplier to have a current NIST SP 800-171 self-assessment posted to SPRS. Without it, the SaaS could not even appear on the prime's approved-vendor short-list, regardless of how strong the product was on the technical merits. Two, several of the prime's downstream customers (notably the Air Force Research Laboratory at Kirtland and a couple of Sandia program offices) required FedRAMP-Low-aware controls for any tool that crosses into their environment, even if the SaaS itself did not need a full Authorization to Operate. Three, the partner motion required for the defence corridor (vendor onboarding, security questionnaires, Trade Agreements Act flow-down, ITAR-aware data residency assertions, past-performance documentation, capability statements) was simply not a thing the founding team had ever run.

The deeper problem under all three: the prime's procurement clock runs in fiscal-year cycles tied to the federal calendar, so missing one round of vendor-onboarding paperwork means waiting six to nine months for the next prime-led teaming opportunity. Two of the founder's strongest inbound inquiries had already moved that direction. The cost of doing nothing was not just slow growth, it was a measurable opportunity-cost line on the founder's own deal log.

Workstream 1 · NIST SP 800-171 Rev. 3 self-attestation. Full gap assessment against the 110 security requirements in NIST SP 800-171 Rev. 3. System Security Plan drafted, Plan of Action and Milestones tracked weekly, and the resulting score posted to SPRS via SAM.gov. Coverage areas: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, system and information integrity.

Workstream 2 · AWS GovCloud (US) migration with FedRAMP-Low controls. Migrated workloads from commercial AWS regions to AWS GovCloud (US). Aligned to the FedRAMP-Low baseline (a subset of NIST 800-53 Rev. 5 controls), with FIPS 140-3 validated cryptography, US-citizen-only operations staffing for the GovCloud tenancy, and full audit logging into CloudWatch + an immutable S3 GovCloud archive. The architecture is ATO-ready, even though a full ATO is a 12 to 18-month follow-on project.

Workstream 3 · Continuous-compliance tooling. Stood up continuous compliance evidence collection through Vanta with the NIST 800-171 framework template, then layered Drata for the SOC 2 Type II evidence trail the founder's commercial customers still required. Daily automated control checks, monthly evidence packages exported to a defence-prime portal, quarterly internal audit.

Workstream 4 · SSO, RBAC, and CUI-handling boundary. Implemented SAML 2.0 SSO via a federal-friendly identity provider, role-based access control with separation-of-duty enforcement, and a clearly-bounded CUI-handling module that segregates Controlled Unclassified Information from commercial-tier data. Audit-trail every administrative action; export the trail on demand for prime-subcontractor security questionnaires.

Workstream 5 · Sandia-corridor partner channel. Built the partner motion: capability statement aligned to the prime's Statement of Work language, past-performance write-ups stripped to the redactable subset, sub-tier vendor onboarding kits, security questionnaire library (the common 280-question security review pre-answered), and a partner enablement portal. Channel pipeline 6x'd over 12 months once the NIST 800-171 attestation landed in SPRS.

Two cross-cutting choices made the workstream timing work. First, the SPRS score posting in week 9 (right after the Workstream 1 gap-close) became the unlock signal for every other workstream's outbound conversation. Second, the GovCloud migration in Workstream 2 ran ahead of the partner-channel work in Workstream 5 by exactly six weeks, so by the time the first prime asked for an architecture diagram, the GovCloud tenancy was already a live production environment with three weeks of operational telemetry behind it. Sequence matters; we have rebuilt this 14-week plan four times and the sequencing is the part that did not move.