November 12th, 2026 @5:30 PM – Ethan First – The Cost of Trust in Federal Markets:Can Progressive Assurance Lower Barriers Without Weakening Cybersecurity?

Register: This is a Hybrid meeting. A dinner meal will be served (Meal menu TBD). REGISTER HERE for IN PERSON & ONLINE MS Teams, Location Broadcom Office 12100 Sunset Hills, 4th Floor Suite 400, Reston, Virginia 20191 United States. Metro Station Accessible. Registration closes on Wednesday 07/15/2026.

Abstract
The federal government obligated about $793 billion through contracts in fiscal year 2025, creating a substantial market for private-sector products and services. Yet small, midsize, and nontraditional suppliers often face a structural barrier: they may need to fund secure environments, personnel, processes, documentation, and independent assessments before they can win the contracts whose revenue would support those investments.

This harms both sides of the market. Capable companies may forgo federal opportunities because they cannot justify or finance the full up-front implementation burden. Agencies may lose access to innovative technologies, specialized expertise, and additional competition.

This session asks whether progressive assurance can lower that barrier without lowering the required security outcome. Using FedRAMP, agency FISMA practices, and CMMC as case studies, Ethan First will examine models that validate critical outcomes, recognize credible existing evidence, permit bounded and time-limited use, require continuous monitoring, and enforce progression to full assurance. Drawing on Automata’s federal authorization experience, the session will distinguish staged assurance from partial compliance and identify safeguards that could allow early contract revenue to help fund full implementation without exposing federal information to unmanaged risk.

Bio
Ethan First is Chief Technology Officer of Automata LLC, a federal security and compliance consulting firm. He advises cloud providers on FedRAMP readiness, security architecture, and authorization and certification, with experience spanning Revision 4, the transition to Revision 5, and FedRAMP 20x. Supporting NIH, he led multi-cloud security and FISMA High authorization efforts across AWS, Azure, GCP, and enterprise SaaS platforms. He has led CMMC Level 2 programs from boundary scoping and gap assessment through technical implementation and independent C3PAO certification assessments. Through Automata, he led an embedded security team that helped a defense contractor valued at more than $1 billion achieve CMMC Level 2 certification. His work combines federal compliance expertise with hands-on security engineering to help organizations implement, demonstrate, and sustain effective security programs.