Is public sector worth it before the A — and what do FedRAMP and CMMC actually take?

You are probably not ready for this, and the honest answer for most seed-stage security companies is not yet. Public-sector revenue is real — in our portfolio it was among the most reliably renewing a company held, often paid up front — and that is exactly what makes it a trap at this stage, because the money looks like the easiest on offer and costs the most attention to reach. Unless you are building for this buyer on purpose, or an agency with a funded program is already asking, the answer is later. What follows is what it costs if you are the exception, and how to tell whether you are.

The test for entering before the Series A.

You enter the public sector before the Series A when a buyer with a funded program is already asking, when your buyer is public sector by nature, or when a prime contractor needs you for a bid it is likely to win. You do not enter it because the money costs no equity, because an agency was curious, or because a grant arrived. Write down the owner, the budget line, and the contract vehicle. If any of the three is blank, wait.

The revenue renews, on their calendar.

You will find that public-sector contracts renew more reliably than almost anything commercial, because a program with a budget line and an owner renews until someone decides to stop it, and nobody is paid to decide that. You will also find that the revenue arrives on the agency's calendar, not yours. A change of leadership at a single agency can freeze a close that was already scheduled. The end of a fiscal year can pull a deal forward or push it back a year. Forecast to their calendar, and never to a quarter of yours.

Pilot money is not revenue.

Pilots, research grants, and innovation awards arrive first, and federal opportunities routinely look enormous, go quiet, wake up, and deliver one-time pilot money that never becomes a funded program. Book it as what it is, paid development work, and never as the first year of a customer. The test is whether an owner with a budget line has named your product in a plan that outlives the pilot. If nobody has, you have a grant.

It needs its own person.

Public sector run from the founder's calendar, between commercial deals, produces curiosity and no contracts. The sector has its own vocabulary, its own contract vehicles, its own calendar, and its own people who have sold into it before. Enter it with a person who has, or with a partner who has, or do not enter it. A half-staffed public-sector effort is the most expensive way to learn that the sector exists.

Authorization needs a sponsor and takes years.

The question comes early, whether the product is FedRAMP authorized, and authorization is not something you buy. It needs an agency sponsor that wants your service enough to carry it through the process. It needs an assessment by an accredited assessor, a security package that amounts to a year of engineering for a small team, and continuous monitoring afterward. The path runs in years and in real money, and the listing on the marketplace at the end is what the next agency reads. Do not start it on speculation. Start it when a sponsor has said in writing that it will carry you, and price the year of engineering into the round that pays for it.

Sell through a prime first.

The first federal customer comes faster through someone who is already inside. A prime contractor that holds the contract vehicle and needs your capability to complete a bid. A platform that is already authorized and can deliver your product inside its boundary. A reseller that holds the schedule. Each of them hides the sales cycle rather than removing it, each takes margin, and each gets you into a funded program years before your own authorization would. Sell through first, and pursue your own authorization when the revenue justifies it.

The defense certification is the customer's gate.

The defense supply chain's certification appears when a customer that handles controlled information needs its vendors to hold the level its contract requires. It is a gate on the customer's contract, not a judgment on your product, and the level they need decides the cost to you. Ask which level, in writing, before you scope anything, and ask whether the requirement applies to their current contract or is expected on the next one, because the difference is a year. The requirement is newer than the rest of this and still settling, so confirm the level and the version against their actual contract rather than against what you heard last year.

State and local is a different market.

State, local, and education buyers purchase through cooperative contracts and state vehicles, on a calendar that follows the fiscal year, with a security review that names its own framework. It is closer to the mid-market than to federal, it renews the same way, and it needs a partner who holds the vehicle. Treat it as its own segment with its own person.