The stall
Discovery is not the gap. Stability is.
You have already been assessed. You have already been briefed. The program still cannot put a bounded first decision in front of a named owner. The missing piece is usually not another inventory. It is the work of stabilizing what you already run so a named door onto DoD cloud can actually succeed.
The estate is still noisy
Systems keep running, but ownership is fuzzy, dependencies are unclear, and day-to-day operations stay reactive. Cloud plans stall because nobody trusts the current state enough to change it.
Assessments arrive as catalogs
Sponsors do not need another list of servers. They need a sequence: what to stabilize first, what hygiene to finish, and which door onto DoD cloud unlocks the rest.
Authority gets diluted
Recommendations that pretend to be decisions leave the Authorizing Official holding risk they never accepted. Evidence informs. Named people decide.
The offer
Three questions a sponsor actually asks.
Everything in the six weeks serves one of these. They are asked in this order because this is the order a decision maker asks them — not the order a workstream is staffed.
Leverage
Which systems and practices are already solid enough to keep — so you do not rebuild what still works.
Stabilize
What hygiene, ownership, and operating practices must be fixed before anything moves — so the estate is ready to operate at cloud speed later.
Sequence
Which door onto DoD cloud begins now, and which can wait — so the program stays consumable and the sponsor stays in control.
What you walk away with
You leave with decisions, not a binder.
Three depths of one conversation — not three disconnected documents. One evidence trace, read at the depth each audience needs. The point of the leave-behind is a clear next decision sitting in front of a named owner — which door onto DoD cloud, what to stabilize first, and who owns residual.
Executive brief
What the engagement revealed, which door you are positioned to take, the constraints to work first, and the decisions sitting in front of named owners.
Transformation plan
How the strategy becomes work: first wave, sequence, dependencies, decision gates, and a 0–48 month horizon.
Technical analysis
Artifact-level evidence, the standards it answers to, architecture, and the trace an assessor can follow.
Five artifacts DISA and the AO will ask for
Named objects. Not a binder. Not occupancy.
Two on-ramps, the PA versus first occupancy, a named C-ITP, three-column inheritance, one-prime IATT set. Six weeks names them. It does not file them. IATO is gone. First occupancy is IATT, not operations.
Two on-ramps
Buy (DITCO / DAPPS) is not connect (SNAP / CPTC / BCAP). Sequence them.
Artifact 2PA vs occupancy
Do not write 'the CSP is IL5.' Eight services the first occupancy will actually call.
Artifact 3Named C-ITP
The SNAP object. Boundary, IL, AO. Twelve bases are on-ramps, not twelve projects.
Artifact 4Three columns
CSP PA · access plane · mission residual. The AO initials. Reciprocity is not automatic.
Artifact 5One-prime IATT
Which prime, which folder, which one site, testers, data, exit. Do not occupy four CSPs.
What it costs your calendar
Light on your people. Heavy on the decision.
This is where consulting sales stall — and where Phase Zero is built to be specific. Your organization provides context and access. It does not staff a new program to receive the work.
Four named contacts
Technical, mission, security/ISSO, and a data steward. Not a working group.
One or two interviews each
Clarification, not a discovery program your staff have to run.
Three sponsor reviews
Weeks 1, 5, and 6. The rest of the calendar stays yours.
Mission outcomes, the strategic question, stakeholders, handling boundaries.
Approved cloud, data, security, authorization, application, and financial evidence.
Peer programs and proven practice. Find the leverage and the constraints.
Client-specific cloud and AI principles. Guardrails and due diligence — not detailed design.
Foundations, dependencies, investment decisions, accountable gates.
Pressure-test with stakeholders. Agree the next bounded decision and its owner.
Why this is not a blank-page assessment
The base does not change per client.
Invariance is the trust argument. A map that changes per engagement is an opinion. Your evidence becomes confirmed markers on lanes that already exist — derived, never asserted. Peer programs walked this ground. The standards you are held to are already on the page.
Thirty-four distinct standards, fifty-seven pairings. National security midsize agencies, IL5 and below. FedRAMP High sits on the IL5 path — it is a requirement, not a civilian-agency offering. The method is stable.
Base established first. Each overlay is drawn on the same map — not a new assessment.
The destination
Four doors onto DoD cloud. Hygiene first. Occupancy is the point.
Join a program (Cloud One, ECMA, Platform One, Black Pearl), order JWCC, stand up with your own team or a local provider on the known road, or hybrid. Phase Zero names the door. It does not occupy it.
Join a program
Occupy ECMA/cARMY or DAF Cloud One for hosting, and/or Platform One or Navy Black Pearl for the factory. Years traded for onboarding.
ForkStand up
Own Cloud Foundation Team, own landing zone, own residual. A local provider may build — only on OEM GovCloud and program patterns that already exist.
ForkHybrid
Occupy someone else's hosting and keep the factory — or the reverse. Platform One on Cloud One is the pattern the Department already runs.
VehicleJWCC as vehicle
A CLIN that can pay the IL this fiscal year. Every occupancy door still needs a bill.
How you get there
Build, contract, acquire, or join.
Most decks omit Join because it is awkward to sell. We put all four on one screen, with what you would still own the morning after. The client draws the conclusion.
Build
You own it the morning after. You also staff it the morning after.
Contract
A vendor delivers a slice. You still own the seam and the authorization boundary.
Acquire
A service, not a system. Consumption instead of construction — with the obligations of tenancy.
Join
Inherit as a tenant of a program that already runs it. Years traded for onboarding.
Where this is allowed to run
Your evidence never enters our hosted surfaces.
Approved DoD and IC engagements use a protected offline workbench inside a client-approved environment. CUI, classified material, interview records, and mission data do not leave that boundary. Handling is agreed before any workspace is opened — not after.
Client-approved AI, GCC High Copilot, or manual review in place. Source documents are not uploaded elsewhere. Scheduling mail is for scoping only. Do not send credentials, CUI, or mission data by email.
Who this is for
National security midsize agencies. IL5 and below.
DoD / IC missions that still have to occupy a government-cloud partition, inherit a DISA PA, and put FedRAMP High on the IL5 path. Civilian-agency, state, local, and commercial work stays out. Day and night sit on top of one look: Ridge.
What you are buying
Phase Zero. What follows is optional, and yours.
You are not buying a transformation program. You are buying a six-week instrument that puts a bounded next decision in front of a named owner. Phase One and Phase Two exist so the handoff is real — not so a statement of work can sprawl.
Strategy and direction
The engagement you are buying. Three reports. One next bounded decision, with an owner.
Execution foundation
Receives the Phase Zero handoff. Application record, operating decisions, evidence contracts. Optional.
First increment
A bounded modernization slice with rollback evidence and a day-two owner. Optional, and yours to staff.
What this declines to claim
Authority stays where it belongs.
Evidence informs. Named individuals with authority decide. That sentence is not fine print. It is the pitch.
Not a migration
Nothing moves in Phase Zero. The work is to know which door, what should move later, and what has to be true first.
Not an authorization
No score becomes acceptance. No recommendation becomes an ATO. The Authorizing Official owns every decision that follows.
Not a software product
Readiness is a delivery lane, not something you license. Access, retention, and handling are agreed before any workspace is opened.
Not a program to staff
Your people provide context and access. They do not stand up a new PMO to receive the work.
A bounded next step
A conversation. Then a fixed-scope ROM. Nothing priced before.
Confirm the mission question, the systems that still need to run cleanly, the evidence-handling path, and sponsor and participant roles first. No commitment beyond the conversation. Scheduling and scoping only.
- The mission question the sponsor needs answered
- The evidence-handling path — including enclave, if required
- Sponsor and the four named points of contact
- Whether Phase Zero is the right instrument, or not
Do not send credentials, client evidence, CUI, mission data, or other sensitive material by email. Evidence handling is agreed first.