Track 08 · Deployment & opsLesson 11 of 11
Delivering for government
Accreditation, accessibility, records and procurement, and how they change delivery.
- Specialisation · Government
- 35 min read
- 75 min hands-on
- Pro
What you'll be able to do
01- Explain how a system gets authorised for US government use: the agency's authority to operate, FedRAMP for federal agencies, GovRAMP or a state's own review, and DoD impact levels in outline (as of October 2026).
- Build an evidence map from components to NIST SP 800-53 controls, and decide which gaps stop the package and which can wait on a plan of action.
- Turn accessibility, language access, public records and due process into acceptance criteria, and check generated HTML for the part a machine can check.
- Read a procurement shape for what it fixes: the scope, who can change it and how long that takes.
- Plan for the people who can stop go-live, and know what changes for defence or classified work.
Before you start
- Self-hosted, VPC and air-gapped: running with no outbound internet. This lesson asks who signs for it.
- Data residency and sovereignty: where data may sit.
- Threat modelling an AI system: the threats behind the controls.
- The audit pack: evidence an auditor can check without you.
- Approval gates and bounded autonomy: why a determination is never an agent action.
Starting here? This lesson anchors the government elective. An authority to operate (ATO) is a named official's written acceptance of the risk of running a system; that official is the authorising official, often the CISO. The system security plan says how each control is met, the assessment tests it, and the plan of action and milestones (POA&M) lists what isn't met yet, with owners and dates. A prime holds the contract; a subcontractor works under it.
The short version
Government work looks like enterprise work with more paperwork. The difference is that the paperwork is law, policy or contract, it's public, and a named person signs it. Before production, a security official authorises the system against a control catalogue, usually NIST SP 800-53, on evidence you supply and keep current. The cloud service underneath needs its own verification: FedRAMP for federal agencies, mid-rewrite as of October 2026, and for states GovRAMP or the state's own review. The interface must meet an accessibility standard by a dated deadline. Transcripts are public records. People with limited English get the same service. Eligibility decisions stay with people and can be appealed. The contract fixes the scope. Public employees' work changes only after their union has been told.
The FDE turns each of those into a design decision, a test and a date, so the go-live decision is made on evidence.
- The agency authorises the system. A FedRAMP or GovRAMP status lets it reuse an assessment of the cloud service; it doesn't replace the agency's ATO.
- Evidence ages. Authorisation is kept up by continuous monitoring, not passed once.
- Duties are acceptance criteria. Accessibility, language access, records and due process each get a test, an owner and a date.
- The contract is the scope. Anything outside it waits for a change order.
Pro lesson
The rest of this lesson is in Pro.
The mental model, worked example, field note, failure table, exercise and self-check, with the voice tutor.
- Every stage and specialisation, in full
- Every lab and every role project
- Halden weeks 2–10, on your record
- Every drill, live in the playground
- All solutions, plus the server judge
- Lab Assistant and every Teach with AI