The arc, phase by phase
- Phase 1 — read the instrument. Your GSA contract or order defines which systems are in play and invokes the process. The guidance framework (built on NIST SP 800-171 — with GSA's process among the early movers to Rev. 3 and agency-defined ODP values) tells you what the review will measure. Both documents before any engineering.
- Phase 2 — scope and implement. Boundary definition, 800-171 implementation at the specified baseline, and ODP values aligned to what GSA defines. Same Factory stations, GSA-specific output.
- Phase 3 — clear the showstoppers first. GSA's process treats certain requirements as authorization-blocking. Sequencing them first is the difference between a package that moves and one that boomerangs. This is triage, and it's knowable in advance.
- Phase 4 — the package. SSP, POA&M, and objective-level evidence assembled in the structure GSA reviewers expect. A package organized to the reviewer's checklist reads fast; a package organized to your file system reads slow, and slow reads find problems.
- Phase 5 — the authorization decision. A GSA authorizing official reviews and decides. Expect questions; the practitioners who built the environment should be the ones answering them.
- Phase 6 — continuous monitoring. The decision starts an obligation: evidence refresh, change reporting, POA&M management, and periodic re-evaluation. Authorization is a subscription, not a purchase — budget the operating rhythm from day one.
Why this lane rewards preparation: unlike a scheduled assessment you can cram for, an authorization lifecycle continuously measures whether your program is real. The contractors who do well are the ones whose evidence discipline was operational before Phase 4 — which is the entire design philosophy of the Factory.
The whole arc
Get authorization-ready — and stay authorized.
Tell us where your GSA work stands and a practitioner will map your phase, your showstoppers, and the continuous-monitoring rhythm behind the decision. Or email rj@indirectit.com directly.