Government ERP modernization projects — replacing COBOL-era financial management, HR, or case management systems with commercial SaaS or cloud-native replacements — share a failure pattern that procurement-focused programme offices consistently underestimate: the FedRAMP authorization problem. The replacement system must be FedRAMP authorized before it processes Controlled Unclassified Information (CUI). Getting it authorized takes 18-24 months for a new cloud service offering and 3-6 months for a significant change to an existing ATO. The legacy system is typically under a concurrent ATO that doesn't cover the new architecture. The data migration runs through a transition period where both systems exist. This is the problem nobody budgets for.
The Parallel Authorization Problem
Federal agencies operating under OMB Circular A-130 and FISMA 2014 must maintain continuous authorization for all information systems that process federal information. During an ERP migration, there are two information systems: the legacy system (authorized) and the replacement (being authorized). The migration environment — which processes data from the legacy system to populate the replacement — is typically a third system, potentially without its own ATO. The migration tooling must either be included in the replacement system's authorization boundary or operated under a separate ATO. Most programme offices discover this constraint at Authority to Operate review, not at programme kickoff.
The CUI data classification creates an additional constraint. Under 32 CFR Part 2002 and NIST SP 800-171, CUI must be protected with specific controls throughout its lifecycle. When CUI moves from the legacy system to the migration environment to the replacement system, each transfer must occur within authorized boundaries, using encrypted channels, with access logging that satisfies CUI audit requirements. A data migration that extracts CUI from the legacy system to a contractor-operated migration environment is potentially a CUI handling violation if the migration environment is not operating under an appropriate authorization.
FedRAMP Marketplace reuse — selecting a replacement ERP that is already FedRAMP authorized — solves the cloud service authorization problem but does not solve the agency ATO problem. An agency must issue its own ATO (Authority to Operate) for any system it operates, even if the underlying cloud service has a FedRAMP authorization. The agency ATO adds system-specific controls to the FedRAMP baseline and requires agency-specific risk acceptance. This is typically 3-6 months of work even for a FedRAMP-authorized service.
Data Migration with CUI Controls Intact
The data migration architecture for a government ERP modernization must maintain CUI controls throughout. Specifically: extraction from the legacy system must use encrypted export formats with access logging; migration staging must occur in an authorized environment (either the replacement system's authorization boundary or a separately authorized migration environment); data validation and transformation must be performed by authorized personnel using authorized tools; and the migration completion must be followed by verified destruction of CUI from the legacy environment (or deauthorization of the legacy system with CUI purge documentation).
Testing in Authorized Environments
- UAT environments for FedRAMP-authorized systems must be within the authorization boundary — you cannot run UAT on a non-authorized cloud instance that processes real federal data
- Performance testing with real data requires a production-equivalent authorized environment — synthetic test data is acceptable for functional testing, but performance baselines require realistic data volumes
- Security testing (penetration testing, vulnerability scanning) must be coordinated with the CSP and documented in the system security plan — unauthorized security testing of FedRAMP systems is a compliance violation
- Disaster recovery testing must be documented as part of the ATO — an untested DR plan does not satisfy FedRAMP's contingency planning control family (CP-4)
The engineering behind this article is available as a service.
We have done this work — not advised on it, not reviewed documentation about it. If the problem in this article is your problem, the first call is with a senior engineer who has solved it.