Digital Svcs Playbook # 11

[warnerjk]

Authors come close to commenting in referencing FEDRAMP, but suggest in your checklist under this Play, or other appropriate section you indicate clearly that federal civilian agencies require vendors/solutions with an existing Authorization to Operate (ATO) certification. If in an acquisition phase, soliciting vendors without such but is a requirement, can either forestall execution/deployment for untenable amount of time dependent upon when agency ATO is granted or acquisition termination for convenience because vendor is unable to attain ATO. Unfair cost burden placed upon vendors if not clearly vetted prior to RFP.