An Albuquerque federal-adjacent SaaS · $90K → $420K MRR.

The pre-engagement state was purely commercial. $90K MRR on a commercial AWS region, single-tenant. No Controlled Unclassified Information handling boundary. No NIST 800-171 self-attestation on file in the SAM.gov Supplier Performance Risk System (SPRS) score record. No audit trail, no separation-of-duty controls, no SAML SSO.

The stack was a typical commercial-SaaS combination: Next.js front end, a Python service tier, Postgres, Stripe, Auth0, and vanilla AWS networking inside a single VPC. Nothing wrong with any of those choices on the commercial side. But every one of them became a question mark the moment a defence prime's security team asked, "show us your boundary diagram and your CUI flow-down".

Three structural problems were compounding the revenue ceiling. One, defence-prime subcontractor contracts that touch CUI (Controlled Unclassified Information) require a current NIST SP 800-171 self-assessment posted to SPRS. Without it, the SaaS could not even appear on the prime's approved-vendor short-list, no matter how strong the product was.

Two, several of the prime's downstream customers required FedRAMP-Low-aware controls for any tool crossing into their environment. That group included the Air Force Research Laboratory at Kirtland and a couple of Sandia program offices. The requirement held even though the SaaS itself never needed a full Authorization to Operate.

Three, the partner motion the defence corridor runs on was new to the founding team. Vendor onboarding. Security questionnaires. Trade Agreements Act flow-down. ITAR-aware data residency assertions. Past-performance documentation. Capability statements. All of it was fresh ground.

Under all three sat a deeper problem: the clock. The prime's procurement runs on fiscal-year cycles tied to the federal calendar. Miss one round of vendor-onboarding paperwork, and you wait six to nine months for the next prime-led teaming opportunity.

Two of the founder's strongest inbound inquiries had already slipped that way. So the cost of doing nothing was not just slow growth. It was a measurable opportunity-cost line on the founder's own deal log.

Workstream 1 · NIST SP 800-171 Rev. 3 self-attestation. We ran a full gap assessment against the 110 security requirements in NIST SP 800-171 Rev. 3. Then we drafted the System Security Plan, tracked the Plan of Action and Milestones weekly, and posted the resulting score to SPRS via SAM.gov.

The coverage spans the full control set. Access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.

Workstream 2 · AWS GovCloud (US) migration with FedRAMP-Low controls. We moved workloads from commercial AWS regions to AWS GovCloud (US). Then we aligned the build to the FedRAMP-Low baseline, a subset of NIST 800-53 Rev. 5 controls.

In practice that means FIPS 140-3 validated cryptography, US-citizen-only operations staffing for the GovCloud tenancy, and full audit logging into CloudWatch plus an immutable S3 GovCloud archive. The architecture is ATO-ready. A full ATO stays a 12 to 18-month follow-on project.

Workstream 3 · Continuous-compliance tooling. We stood up continuous compliance evidence collection through Vanta with the NIST 800-171 framework template. Then we layered Drata on top for the SOC 2 Type II evidence trail the founder's commercial customers still required. Daily automated control checks. Monthly evidence packages exported to a defence-prime portal. Quarterly internal audit.

Workstream 4 · SSO, RBAC, and CUI-handling boundary. We implemented SAML 2.0 SSO via a federal-friendly identity provider, plus role-based access control with separation-of-duty enforcement. A clearly-bounded CUI-handling module segregates Controlled Unclassified Information from commercial-tier data. Every administrative action lands in the audit trail. The trail exports on demand for prime-subcontractor security questionnaires.

Workstream 5 · Sandia-corridor partner channel. We built the partner motion from scratch. That meant a capability statement aligned to the prime's Statement of Work language, past-performance write-ups stripped to the redactable subset, sub-tier vendor onboarding kits, a security questionnaire library with the common 280-question review pre-answered, and a partner enablement portal.

The channel pipeline 6x'd over 12 months, once the NIST 800-171 attestation landed in SPRS.

Two cross-cutting choices made the timing work. First, the SPRS score posted in week 9, right after the Workstream 1 gap-close. That posting became the unlock signal for every other outbound conversation.

Second, the GovCloud migration ran exactly six weeks ahead of the partner-channel work. So when the first prime asked for an architecture diagram, the GovCloud tenancy was already live, with three weeks of operational telemetry behind it. Sequence matters. We have rebuilt this 14-week plan four times, and the sequencing is the one part that never moves.