Steelhead Technologies
FedRAMP Moderate Equivalency — Program Progress
Updated weekly · Last update: April 13, 2026
Program Start
Q1 2026
Early Q1 2026
Target Authorization
Q4 2026
~9 months to ATO
Controls Scope
325
NIST 800-53 Moderate baseline
Control Coverage
33%
Compliance platform coverage
Controls w/ Mapped Evidence
107
of 325 controls mapped so far
Current Phase
Phase 1
Policy & documentation
Program Phases
Phase 1
Policy & Documentation Finalization
● Active
Q1 – Q2 2026
Progress
50%
- Policy gap analysis complete
- 8 policies rebuilt to FedRAMP format
- Initial policies uploaded to compliance platform
- Policy 605 (Disaster Recovery) final draft uploaded to Drata
- Remaining policy uploads & control mapping in progress
- Formal role designations in progress (ISSO, System Owner, AO)
- Roles & Responsibilities sign-off and documentation in progress
- Configure compliance platform for all 325 controls
- Finalize 2 remaining policy drafts
Phase 2
System Security Plan (SSP) Development
● Active
Q1 – Q2 2026
Progress
10%
- SSP template & structure drafted — system description in progress
- Write narratives for all 325 NIST 800-53 controls
- Document interconnection security agreements (CA-3)
- Conduct initial formal Risk Assessment (RA-3)
- Initialize Plan of Action & Milestones (POA&M)
Phase 3
3PAO Selection & Engagement
● Active
Q1 – Q2 2026
Progress
55%
- RFPs issued to FedRAMP-authorized assessors
- Discovery meetings held with assessor candidates
- Peer benchmarking with industry counterpart complete
- All 4 proposals received from shortlisted assessors — evaluation underway
- Scoring proposals against Q4 2026 assessment slot availability & criteria
- Select 3PAO and confirm assessment window
- Execute contract; lock Q3 2026 assessment window
- 3PAO kickoff & evidence request list
- Book penetration testing firm
- Optional: informal readiness pre-assessment to identify gaps before formal review
Phase 4
FedRAMP-Compliant Environment Buildout
⏳ Starting Q2 2026
Q2 2026
Progress
0%
- Provision FedRAMP-authorized cloud infrastructure
- Enable security monitoring, logging, and audit services
- Deploy security observability agents across all boundary systems
- Configure access-controlled virtual desktop environment
- Validate deployed architecture against SSP boundary diagram
Phase 5
Evidence Collection & Security Testing
Not Started
Q2 – Q3 2026
Progress
0%
- Collect & upload evidence for all 325 controls
- Complete 90-day continuous monitoring observation window
- Conduct authenticated vulnerability scans (all boundary components)
- Complete external & internal penetration test (CA-8)
- Execute contingency plan & disaster recovery testing
- Remediate findings; close high-priority POA&M items
Phase 6
3PAO Formal Security Assessment
Not Started
Q3 – Q4 2026
Progress
0%
- 3PAO document review (SSP, all policies, POA&M)
- Control testing, configuration review & staff interviews
- Security Assessment Report (SAR) delivery
- Assessment finding remediation
- Final POA&M compiled; authorization package prep begins
Phase 7
ATO Package & Authorization
Not Started
Q4 2026
Progress
0%
- Finalize SSP incorporating all assessment updates
- Compile complete authorization package
- Internal Authorizing Official (AO) review
- AO signs Authorization to Operate (ATO) letter
- Package available for customer & prospect delivery
Key Milestones
Timeline
Milestone / Deliverable
Status
Q1 2026
Program kickoff; assessor outreach begins; policy documentation sprint starts
✓ Complete
Q1 2026
Requests for proposal issued to 5 FedRAMP-authorized third-party assessment organizations
✓ Complete
Q1 2026
Discovery meetings held with assessor candidates; all 4 formal proposals received from shortlisted assessors; peer benchmarking with industry counterpart complete
✓ Complete
Early Q2 2026
Phase 1 policies approved, uploaded, and mapped to compliance platform; control coverage at 50%
In Progress
Mid Q2 2026
3PAO selected; Q3 2026 assessment window confirmed and reserved
Upcoming
Mid Q2 2026
All policies live in compliance platform; FedRAMP roles officially designated and signed
Upcoming
Mid Q2 2026
3PAO contract executed; assessment window locked; penetration testing firm engaged
Upcoming
Late Q2 2026
All policies live; SSP structure complete; FedRAMP-authorized cloud environment provisioned; 90-day observation window begins
Planned
Late Q2 2026
All 325 SSP control narratives complete; cloud environment architecture validated against SSP
Planned
Q3 2026
Penetration test & disaster recovery test complete; POA&M remediation complete; 90-day observation window closes
Planned
Q3 2026
3PAO formal assessment begins — document review and control testing phase
Planned
Q4 2026
3PAO assessment testing complete; Security Assessment Report (SAR) delivered; findings remediation begins
Planned
Q4 2026
Authorization package assembled and submitted to internal Authorizing Official
Planned
Q4 2026
🏆 Authorization to Operate (ATO) granted — FedRAMP Moderate Equivalency achieved
Planned
NIST 800-53 Control Family Coverage
AC
Access Control
AT
Awareness & Training
AU
Audit & Accountability
CA
Security Assessment
CM
Configuration Mgmt
CP
Contingency Planning
IA
Identification & Auth
IR
Incident Response
MA
Maintenance
MP
Media Protection
PE
Physical & Environmental
PL
Planning
PM
Program Management
PS
Personnel Security
RA
Risk Assessment
SA
System & Svc Acquisition
SC
Comms Protection
SI
System & Info Integrity
Key Program Dependencies
Ongoing Compliance Commitment
📋
Monthly POA&M Reviews
A formal Plan of Action & Milestones process is built into the program from the outset — not just a pre-ATO checkbox. Open risks are tracked, reviewed monthly, and remediated on defined timelines.
🔁
Annual Re-Assessment
FedRAMP Moderate Equivalency is not a one-time event. The program includes annual penetration testing, control re-assessment, and evidence refresh to maintain authorization on an ongoing basis.
🛡️
Continuous Control Monitoring
Automated evidence collection and control monitoring run continuously once the environment is live, providing real-time visibility into control health across all 325 NIST 800-53 Moderate controls.
👥
Dedicated Program Ownership
Named roles — including a dedicated Information System Security Officer (ISSO), System Owner, and executive Authorizing Official — are formally designated and accountable for the program throughout its lifecycle.