What it costs to productize a federal service

The three modelled scenarios in this article run from $14,000 to $735,000 in cash. A single compliance line is most of the top end: a FedRAMP Class C certification, the Moderate-equivalent level, is a $370,000 to $600,000 program once the internal engineering is counted. The economic cost runs at about twice the cash in the two hosted scenarios, and at nearly eight times the cash when you package a service you already deliver, because that path is almost entirely your own time.

The range is wide because the question hides three different projects. Productizing a service you already deliver is a packaging problem. Productizing a hosted product for a civilian agency is a compliance and build problem. Productizing for a DoD customer at Class C is a capital problem. Firms get into trouble by budgeting for the first and discovering they are in the third.

This page gives you a model rather than a number. Where a figure is published elsewhere on the site it is linked. Where it is a planning range rather than a quote, the table says so, and the assumption is listed. The arithmetic is simple enough to recompute.

Cash cost and economic cost

There are two costs, and most budgets only count one.

Cash cost is money that leaves the business: counsel, consultants, assessments, tooling, contractors. It is the number a founder can see.

Economic cost adds the internal hours you spend instead of billing them. At a federal services firm, those hours have a price, because the same person could be on a task order. This is not a theoretical cost. It shows up as a flat revenue quarter and a confused pipeline review.

The model below reports both. The pattern that emerges is consistent: in the first scenario, cash is small and time is large. In the third, cash dominates and time is still large. Either way, the founder's hours are the line that decides whether the project finishes.

A note on rates: internal time is priced at $200 an hour fully loaded, which is a mid-range federal services rate for a senior person. Change it and every internal line moves proportionally.

The seven cost lines

The ranges are planning ranges, not quotes. The compliance range comes from the FedRAMP material below, and the SOC 2 figure that supports the entry path comes from published vendor estimates, cited in the prose. The rest are compiled from what the work takes, and every scenario table below shows exactly what each line assumes.

The two lines that are not in the table are the ones that decide the outcome: founder time, which is inside every line above, and delay, which is covered later.

The compliance line is the one with the widest range, and the one that changed most in 2026, so it gets its own treatment. The Risk-Proof stage is where this decision belongs in the sequence.

FedRAMP replaced its impact levels with certification classes in 2026. The Consolidated Rules for 2026 launched in June, and the classes opened in August. A provider now pursues Class A, B, C or D instead of Ready, Low, Moderate or High. Class A opened on 3 August 2026, Class B and Class C on 31 August 2026, and Class D is expected as a formal option in early 2027. Class A is the entry point, it replaces FedRAMP Ready, and it accepts a completed Readiness Assessment Report or an existing SOC 2 Type II. The key cost difference: an independent assessor is mandatory for Class B, C and D, and not for Class A.

Class A is also not a permanent certification. Once a federal customer is using the service, agencies should not authorize it for more than twelve months unless the provider is actively seeking a higher class. Plan the move with that in mind, and budget the compliance line twice: Class A now, Class B or C inside two years. Legacy Rev5 certifications stay available until 11 June 2027, through agency certification and two limited program-certification pipelines opened on 10 August 2026, and the 2026 rules become mandatory on 1 January 2027.

That puts the realistic entry cost for a new hosted product at the price of a SOC 2 Type II plus the package work, rather than the six-figure authorization this site used to describe. Vendor-published SOC 2 all-in estimates run from $10,000 to $105,000, with $25,000 to $90,000 of internal staff time on top. Class B and Class C reuse the mechanics the legacy tiers described, and our FedRAMP cost breakdown still has the itemized structure, with a note at the top explaining which parts are now legacy.

One compliance line should be zero, and most 2026 budgets still include it. CMMC Phase 2 was paused indefinitely on 13 July 2026. The contractual requirements were scheduled to take effect on 10 November 2026, and the Department of War directed contracting officers to remove the pending requirements from solicitations, though existing contracts need a formal modification before the obligation changes. What remains in force is the underlying obligation: if your contract carries DFARS 252.204-7012, you must still meet NIST SP 800-171 and maintain a SPRS score. A reform task force was still drafting recommendations in late September, so the requirement may return in a different form. Budget engineering hours, not a certification fee, and re-check before you sign anything.

Scenario 1: productizing a service you already deliver

This is the cheapest path and the one most firms should take first. The product is a packaged version of work you have already done: a fixed-scope assessment, a standardized audit, a named methodology with a deliverable.

You are not building software. You are deciding what the thing is, what it costs, and how it is delivered without you.

Elapsed time: six to nine months, most of it the vehicle modification and the sales cycle.

The cash is small enough that most firms can fund it from a single month of margin. The constraint is not money. It is whether the founder will spend 480 hours on a thing that has no task order attached to it.

If you want the specification done with you rather than by you, the published floor for the Architect Workshop is from $25,000, and the Harvest Sprint, which decides which candidate is worth packaging, is from $15,000. Those are the only prices on this page that HARBOR sets; the Build Pilot's floor appears again later, and the other figures are your own costs.

Scenario 2: a hosted product for a civilian agency

This is the scenario most founders picture when they say "product", and it is where budgets first go wrong. The product is real software, hosted, sold as a subscription or a license. That triggers compliance, a build, and a sales motion that did not exist in scenario 1.

Elapsed time: eighteen to twenty-four months, with the compliance work and the sales cycle running in parallel. The Class A step can happen quickly because it rests on a SOC 2 you may already hold. The Class B step is the one that eats a year.

Two things in this table surprise founders. The first is that the build is not the largest line once the transition is counted. The second is that the internal time exceeds the cash. A firm that budgets $360,000 and plans to staff the work with people who are already billable has understated the cost by more than half.

Scenario 3: a regulated product for DoD

This is the scenario where the honest answer is usually no.

Add $200,000 to $500,000 a year of continuous monitoring.

For a firm at $10M in revenue, this is 7.4% of revenue in cash and roughly 23 full-time-equivalent months of internal time. Unless a named customer has committed to buy, it is not a product decision. It is a bet.

That is why the order of spend matters more than the total.

The order of spend

The four phases have to happen in this order, and the expense is not reversible.

1. Validate. Get a named buyer to describe the problem and the budget before you build anything. Cost: time.

2. Sell a founding version. Take a letter of intent or a small paid pilot. Cost: time and a little legal. This is the step most firms skip, and skipping it is the most expensive mistake in this article.

3. Build. Now spend the build money, against a description of the product a buyer has already said they want.

4. Authorize. Only after a customer requires it. FedRAMP is not a marketing asset. It is a cost you incur because a specific sale needs it.

Firms that invert this order spend the compliance and build money before they know whether anyone will buy, and they discover the answer with no budget left. Our FedRAMP post has the case study: $412,000 on a Moderate-equivalent authorization, no customer, eighteen months gone.

The Build Pilot exists partly for this reason. Its 90-day shape forces the build and the outreach to run at the same time rather than in sequence, and its published target is three signed letters of intent by day 90, which is a target rather than a guarantee. The floor is from $50,000, which is a fraction of scenario 2 and a small fraction of scenario 3.

Where the money actually goes wrong

Building before selling. The most common failure, and the most expensive. Early warning: the first three customer conversations are about features rather than a budget line.

Authorizing before demand. The FedRAMP failure mode. Early warning: nobody outside the company can name the agency that will buy it.

Underpricing the first version. Federal buyers compare your price to a labor rate, so a product priced by the hour is compared to a person. Early warning: your price changes when the scope changes.

Staffing with billable people and not counting it. The project looks affordable because the hours are "already paid for". They are not. Early warning: utilisation drops in the quarter the project starts.

Spending on the wrong vehicle. A schedule modification takes months, and a product sold before the vehicle can carry it becomes a sole-source negotiation. Our vehicle guide covers how to check what you hold. Early warning: the sales conversation ends with "send us a quote" and no vehicle to put it on.

The cost of doing nothing

Doing nothing has a number too, because it compounds into the valuation. Take a $10M firm at a 1.1x revenue multiple: $11M of enterprise value. If one product line lifts the blended multiple to 1.5x on the same revenue, the same business is worth $15M. That $4M difference is the number doing nothing costs, and it is larger than every line in scenario 1.

Federal services firms trade at roughly 0.8x to 1.2x revenue. Software platforms trade at 3.0x to 5.0x. The valuation gap post has the acquisition data behind those ranges. The implication for a budget is simple: a product line that reaches 30% of revenue changes the multiple on the whole business, and a year of delay gives that up.

Do not overstate it. The gap only matters if the product works. Scenario 1 costing $110,000 and failing is a bad outcome. Scenario 3 costing $1.54M and failing is a company-threatening one. The asymmetry is the argument for starting at the cheap end.

The worksheet

Copy this and fill it in before you approve any spend.

The last line is the one most budgets omit. A productization project with no stop condition becomes a permanent cost center with a roadmap.

What HARBOR charges

The Harvest Sprint from $15,000 decides which candidate is worth spending on. The Architect Workshop from $25,000 produces the specification. The Build Pilot from $50,000 covers validation and the build together, which is why its 90-day shape forces outreach and product work to run in parallel. Every figure is a floor rather than a quote, and final scope is confirmed in a written statement of work.

Those fees buy the work described on each engagement page. They do not buy the compliance program or the vehicle. The build inside the Build Pilot is a low-code MVP, not a product engineering program, and that difference is the largest single reason a first product overruns. If you want a first read on whether your firm is at the right stage before spending anything, the free Signal diagnostic takes about eight minutes. If the read says the business is not ready, the useful next step is how to productize a government contract, which starts with a question this page cannot answer: whether you own the thing you want to sell.