JAB vs Agency ATO Cost: What Changed After the JAB Was Retired

The FedRAMP Authorization Act of 2022 (Public Law 117-263, Section 5921, enacted as part of the FY23 National Defense Authorization Act) codified FedRAMP in statute and replaced the Joint Authorization Board with the FedRAMP Board as a governance body. GSA announced the new Board and the dissolution of the JAB in May 2024. In August 2024 FedRAMP published its move to one FedRAMP authorization, eliminating the distinction between JAB and Agency authorizations in favour of a single FedRAMP Authorized designation, with historic JAB status simply noted in Marketplace listings.

Two practical consequences followed. First, the JAB P-ATO is no longer a route a CSP can apply to; the prioritization queue that defined the old JAB pipeline is gone. Second, the centralized continuous monitoring that the FedRAMP PMO used to run for JAB-authorized systems was migrated to agency customers. Each agency now owns the ConMon relationship for the systems it uses, rather than FedRAMP running it centrally.

The FedRAMP Board still exists, but it is a governance and oversight body, not an authorization path. It does not issue provisional ATOs to CSPs the way the JAB did. So when older guides, sales decks, and 3PAO vocabulary still say “JAB P-ATO,” treat it as a description of how things worked before 2024, not a choice on today’s menu. The live decision in 2026 is Agency Authorization now versus FedRAMP 20x as it scales.

The table below keeps the JAB-versus-Agency comparison for context, with the JAB column marked historic. It is useful for understanding why the two paths cost what they did and why the JAB was the higher-friction option even when it was available. It is not a live decision aid.

With the JAB retired, the real decision is sequencing, not picking between two competing review boards. For a CSP that needs authorization soon, Agency Authorization against the NIST 800-53 Rev 5 baselines is the available path. It requires a sponsoring federal agency willing to act as the partner AO, accept the operational responsibility of reviewing the Security Assessment Report, and issue the ATO letter. Finding a sponsoring agency takes time, relationship-building, and often dedicated federal business development; the consulting cost page covers the advisory side of sponsor search.

The forward-looking question is whether to wait for, or pilot into, FedRAMP 20x. 20x replaces narrative documentation with machine-readable packages and continuous Key Security Indicator monitoring, and early estimates put Low and Moderate budgets well below the traditional all-in. The Phase Two Moderate pilot closed in March 2026 and general availability is expected in Q3 2026, with FedRAMP signalling that 20x will eventually replace the traditional Low and Moderate agency process. CSPs whose authorization journey extends into that window should read the 20x outlook before committing budget.

The cost arithmetic for the live Agency path is unchanged from the rest of the site. For a typical Moderate-impact commercial SaaS in 2026: $200K to $400K for SSP development and documentation, $400K to $700K for the 3PAO initial assessment including pen testing, $150K to $400K for remediation, $120K to $300K for GRC tooling, $60K to $250K for year-one ConMon, and $120K to $300K for consulting. The all-in lands between $800K and $2M. The FedRAMP ROI calculator works that against federal addressable revenue, where elapsed time, not path label, dominates the business case.