You've heard the pitch: deploy your product against a hardened baseline, find out what breaks, get a remediation plan. But what does a fit study actually produce — and what can you do with it?
This post walks through the concrete deliverables, so you can evaluate whether the study is worth the investment before you commit.
The deliverable: a pre-authorization engineering assessment
The output of the fit study is a written engineering report. It is yours to keep and use regardless of whether Millabs does any follow-on work. Use it with us, use it with another firm, use it internally. The point is you stop guessing.
Here's what the report contains:
Deployment findings
Every failure encountered deploying your product against the hardened baseline, with logs and reproduction steps. These are empirical results from a real deployment attempt — not an architecture opinion, not a checklist review, not a paper assessment.
The study identifies baseline-driven failures — the things that break because the hardened environment enforces constraints that commercial environments don't. Site-specific configurations in the actual target environment may produce additional findings, and the report notes where that's likely.
Image and build analysis
Your container images are scanned and assessed. The report includes base image sourcing recommendations, specific build pipeline changes required, and the target vulnerability posture you need to reach for the authorizing official to sign.
For some language runtimes, no pre-approved hardened base image exists. The report identifies these and scopes the custom build engineering required — typically the single largest remediation work item.
Missing dependency plan
For each managed service the enclave lacks — and most lack several — the report provides the replacement approach and its engineering cost. Managed database? Here's the containerized replacement pattern, the storage requirements, the migration approach, and the estimated effort. Managed cache? Same. Object storage? Same.
Each replacement is described specifically enough that your engineering team — or any qualified DevSecOps engineer — can execute it.
Remediation roadmap
Ordered work items with effort estimates, separated into what your team can do and what requires enclave-specific experience. The roadmap is sequenced: which items can run in parallel, which depend on others, and where the critical path lies.
This is the deliverable that changes the conversation with your program office. Instead of "authorization will take some amount of time and cost some amount of money," you have a specific plan with specific numbers.
Authorization pathway
The named approving authorities, gates, and sequence for your target environment and impact level. Which framework applies (RMF, FedRAMP, CNSSI 1253). Which AO owns the decision. What artifacts are required. The order in which gates must be cleared.
For Tier 3 studies — systems with hardware components or multi-domain requirements — this includes the interconnect agreement between security boundaries and the framework that governs the total system.
Target environment recommendation
Whether to deploy to an existing accredited platform (Platform One's Party Bus, Second Front's Game Warden, a program-office Big Bang environment) or build your own — with the cost and timeline difference between them. For most first deployments, an existing platform is faster and cheaper. The report makes the case either way with specific numbers.
Integration cost for the IT environment
What the receiving IT operations organization will need to absorb to integrate and operate your system after delivery. This is the cost that's almost never scoped — and the one that causes the most friction post-handoff.
Honest timeline and cost
Including, where it is the answer, that your target environment is the wrong one.
What you can do with it
Make a go/no-go decision
The Tier 1 fit screen ($24,500, one week) exists specifically for this — here is what one produced. You get the failure inventory and a read on whether this is a three-week problem or a nine-month problem. If the findings are manageable, you proceed. If the findings reveal a fundamental architecture mismatch, you know before committing budget.
Fund the remediation accurately
The roadmap gives your program office — or your own leadership — a specific number to approve. Not "authorization will be expensive," but "$180K over six months with these specific work items." Budgets are approved on specific numbers, not ranges.
Execute with your own team
The report is designed to be actionable by your engineers. The remediation roadmap separates enclave-specific work (where you may need outside expertise) from application-level work (where your team is already the expert). Many vendors use the study to scope an internal sprint rather than engaging Millabs for follow-on work. That's a fine outcome.
Negotiate with the program office
The integration cost section gives you specific numbers to present to the program office before delivery. Instead of the IT team discovering unplanned work after the system arrives, everyone — vendor, program office, IT operations — sees the real integration cost upfront.
Compare paths
If you're evaluating whether to deploy to Platform One, Game Warden, a program-office environment, or your own enclave, the study provides a concrete comparison. The application-level work is the same regardless of target — the difference is in infrastructure, authorization scope, and operational cost. The report makes that comparison with actual numbers.
What an ATO readiness assessment costs
| Tier | Engagement | Price | Duration |
|---|---|---|---|
| 1 | Fit Screen — failure inventory, go/no-go read | $24,500 | 1 week |
| 2 | Full Fit Study — iterative deployment, complete remediation roadmap | $47,500 | 3 weeks |
| 3 | Multi-Domain / Systems Authorization — multiple impact levels, classified domains, or hardware systems | $82,500 | 5–6 weeks |
Fixed fee. No hourly billing, no change orders for scope discovered during the study — discovering scope is the point.
What it saves
The labor the study displaces is cleared DevSecOps engineering — the most expensive technical labor in the federal market. GSA Schedule rates (Alliant 3, OASIS+) for mid-senior cleared DevSecOps engineers run $145–$200/hr. On the commercial market, the same profile commands $200–$325/hr — and that's if you can find one. Cleared engineers with enclave deployment experience take 3–6 months to recruit; sponsoring a new clearance takes 9–18 months.
From a recent empirical deployment (open-source application against the hardened baseline):
| Fit Screen ($24,500) | Full Study ($47,500) | |
|---|---|---|
| Unnecessary work refuted | 8–13 days ($11K–$18K at GSA) | Same |
| Serial findings discovered | 7 findings (~$10K each to discover on a live platform) | All 7 resolved with working code |
| CVE impact statements | 685 identified | 685 eliminated (0 residual) |
| One-time savings | $21K–$28K direct | ~$148K |
| 5-year lifecycle savings | — | ~$940K at GSA / ~$1.3M at commercial |
| ROI | ~1:1 direct + schedule acceleration | ~20:1 |
The $940K figure is the recurring CVE documentation burden — impact statements that must be written, maintained, and re-validated on every release for every residual vulnerability. With 0 residual CVEs after image hardening, that entire obligation disappears.
The fit screen roughly breaks even on direct engineering savings alone. The schedule acceleration — avoiding 7–21 weeks of serial rejection cycles — is what the program office cares about. The full study's 20:1 return comes from eliminating the CVE documentation lifecycle cost that compounds across every release for the life of the ATO.
What it requires from you
- Read access to your repository and container build definitions
- One to two hours of engineering interview time (your architects explain the application; we explain the baseline)
- Test data — synthetic or vendor-supplied non-sensitive data. No government data, CUI, PII, or restricted-use data is accepted
- A signed mutual NDA and commercial SOW — no federal contract vehicle required
What it does not do
The fit study does not authorize your application. It does not produce an ATO. It does not carry evidentiary weight with an authorizing official.
It identifies what needs to change, scopes how long it takes, and estimates what it costs — so that when you do engage the authorization process, you arrive with a clean product, a complete artifact package, and no surprises.
Millabs is not a 3PAO and does not perform independent assessments. This is engineering work, and the point of finding a defect is to fix it.
See it before you buy it
Millabs will run a free 30-minute diagnostic call — a walkthrough of what the hardened baseline enforces and what we'd expect to find in your product based on your architecture. A redacted sample findings report from a recent engagement is available on request.
You should not take an authorization claim on faith, including this one.
Robert Burckner is the founder of Millabs Corporation, a Service-Disabled Veteran-Owned Small Business. Formerly Division Chief, Space Warfighting Analysis Center (USSF/NRO) and Cybersecurity Chief, AFLCMC.
Ready to find out what the gap looks like? Contact Millabs | 571-730-7459