Modernize legacy government systems without losing your ATO — or your funding.

Usually no, if the work is scoped right. Significant change determinations are made by the AO, but most incremental modernization fits under a Type 2 or Type 3 change with a delta SSP and updated POA&M. We design slices that stay inside the existing authorization boundary where possible, and when a slice does require re-authorization we sequence it so the legacy system keeps its ATO until the new one lands.

It opens set-aside and sole-source pathways. Under the SDVOSB program, contracting officers can sole-source up to $5M (services) without competition when requirements are met, and SDVOSB set-asides are a priority category under the small business goaling framework. For agencies with veteran-spend goals — VA especially under the Vets First program — we count toward category-specific targets, not just generic small business credit.

We start with traffic, not code. Two weeks of read-only observation tells us which screens and batch jobs actually carry load and which are dead weight nobody admits to using. Often 30-40% of a legacy system can be retired outright rather than rebuilt. The remainder gets prioritized by risk: anything touching PII, anything blocking a compliance finding, anything the vendor has dropped support for.

For a FedRAMP Moderate ATO via the agency path, plan on 12-18 months from kickoff to authorization letter, assuming you start with a cloud platform that's already FedRAMP-authorized (GovCloud, Azure Government, Google Assured Workloads). FedRAMP High is longer. The JAB path is mostly closed to new entrants right now. We've seen teams promise 6 months — that's only realistic if you're inheriting nearly all controls and the 3PAO is already engaged.

We assume it will happen and design for it. That means: every deliverable is independently valuable (no big-bang go-lives at month 24), code and infra-as-code live in agency-owned repos from day one, documentation is good enough that a different vendor could continue the work, and we structure milestone payments so a stop-work order doesn't strand the agency with 60% of a system. Continuity is a deliverable, not an afterthought.

We hold or can team into most common vehicles — GSA MAS IT, SDVOSB set-asides, and several agency BPAs. We've also subbed under CIO-SP3, Alliant 2, and OASIS+ prime holders. The right answer depends on ceiling, period of performance, and how much scope flexibility you need. We'll tell you honestly when a different vehicle would serve you better, even when it means we don't prime.

A representative first quarter: weeks 1-2, discovery and ATO boundary mapping; weeks 3-6, stand up the new platform inside the existing authorization boundary and route one read-only endpoint through it; weeks 7-10, migrate a single workflow end-to-end with feature-flag rollback; weeks 11-13, retire the legacy module, update the SSP delta, and demo to the AO. One slice retired, pattern proven, zero downtime, and a template for the next ten slices.

We handle it. Every UI we build is tested against WCAG 2.1 AA with axe-core in CI and manual testing with NVDA and VoiceOver before release. For modernization specifically, we treat 508 as a forcing function — most legacy government UIs fail badly, and rebuilding accessibly is often cheaper than retrofitting. We document conformance in an ACR (VPAT) that your 508 coordinator can submit without rewriting.

Discovery is fixed-price (typically 2-4 weeks, $40-80K range depending on system size). Implementation is usually T&M with a not-to-exceed and milestone gates, because the unknowns in legacy work make true fixed-price either overpriced or a recipe for cut corners. For agencies that need fixed-price for appropriations reasons, we'll do it after discovery — once we've actually seen the code — not before.