FedRAMP zero trust cost: OMB M-22-09 and DoD implementation

OMB M-22-09, the Federal Zero Trust Architecture Strategy memorandum issued by the Office of Management and Budget in January 2022, is the dominant US federal civilian zero trust mandate. Published a year after the Biden administration's Executive Order 14028 on improving the nation's cybersecurity, M-22-09 translated the EO's broad direction into specific measurable targets for federal agencies. The key requirements are concrete enough that compliance can be audited rather than inferred.

Enterprise-managed identity systems for all federal employees and contractors. This means a single enterprise-grade identity provider, not departmental or program-specific IdPs scattered across the agency. For most agencies that meant consolidating multiple legacy identity stores into Microsoft Entra ID Government or Okta Workforce Identity Cloud for Government, a multi-year programme in its own right. Phishing-resistant MFA universal. Not for privileged accounts only, as commercial best practice often implements; for every employee and contractor with system access. FIDO2 hardware keys are the dominant implementation, with platform-resident passkeys increasingly accepted as equivalent. Complete inventory of every endpoint and resource. The traditional federal asset-management gap (devices not on the official inventory but actively in use) had to be closed, driving investment in device discovery and CMDB consolidation. Enterprise-wide IAM aligned with NIST 800-207. The IAM had to implement the architecture from NIST SP 800-207, not just any IAM. Encryption of DNS, HTTP, and email between federal systems. This drove investment in DNS filtering platforms (CISA Protective DNS, commercial alternatives), TLS everywhere, and email security infrastructure. Treat internal networks as untrusted. This is the network-pillar requirement, driving ZTNA adoption and the retirement of broad VPN access. Categorise and protect all federal data with rigorous access controls. This is the data-pillar requirement, driving DLP, classification, and access governance investment.

The original deadlines (end of fiscal year 2024 for most elements) proved aggressive; subsequent CISA implementation guidance extended some deadlines through fiscal year 2027 for the more challenging elements (full data-pillar deployment, comprehensive microsegmentation, full workload identity). The direction is settled and the funding is committed; the timeline has flexed.

The DoD Zero Trust Strategy, published October 2022, is the Department of Defense's equivalent of OMB M-22-09 with additional rigour appropriate for defence environments. The accompanying DoD Zero Trust Reference Architecture (the v2.0 update released July 2022) defines a target architecture for DoD components, with seven pillars (the same five CISA pillars plus visibility and analytics, plus automation and orchestration, treated as separate pillars rather than cross-cutting capabilities) and three time-bound capability levels (Target Level Zero Trust by FY 2027, Advanced ZT as the longer aspiration).

The DoD strategy is more prescriptive than M-22-09 in some areas. It specifies particular capability outcomes (152 zero trust activities across the seven pillars at Target Level, additional 27 at Advanced) and provides detailed implementation guidance per activity. The funding model is per-component budget allocation through normal DoD budget cycles plus dedicated CISA-aligned investment for cross-component capabilities. Component-level zero trust office budgets at major DoD components run $50M to $300M per year for implementation plus ongoing operations.

For DoD contractors not directly under the DoD ZT Strategy mandate, the strategy still matters because it sets the direction for contractor cybersecurity expectations through CMMC and contract-level requirements. Contractors operating in DoD environments increasingly need to demonstrate alignment with DoD ZT principles even when not formally subject to the strategy itself.

CMMC 2.0 (Cybersecurity Maturity Model Certification, the DoD's contractor cybersecurity framework, effective for contracts from 2025 onwards) is mandatory for any contractor handling Controlled Unclassified Information (CUI) on DoD contracts. CMMC has three levels: Level 1 (basic, 17 practices for federal contract information), Level 2 (advanced, 110 practices aligning with NIST SP 800-171, for handlers of CUI), and Level 3 (expert, additional NIST 800-172 enhanced practices, for handlers of higher-sensitivity CUI).

The overlap with zero trust is substantial. CMMC Level 2 requirements substantially overlap with CISA Initial-to-Advanced zero trust capability. CMMC Level 3 requirements align with CISA Advanced-to-Optimal. For DoD contractors, the zero trust implementation cost and the CMMC certification cost are largely shared: the same identity-pillar work satisfies both, the same device-pillar work satisfies both, the same network-pillar work satisfies both. Most DoD contractors approach CMMC and zero trust as a single integrated programme rather than two separate efforts.

The cost-sharing implication is meaningful. A defence contractor that scopes CMMC compliance and zero trust separately typically duplicates 40 to 60 percent of the work. An integrated programme saves $300K to $1.5M per year for mid-market defence contractors and significantly more for enterprise contractors. The pcicompliancecost.com sister site covers a similar pattern for PCI-DSS compliance integration with zero trust, though for a different mandate.