Plan GSA authorization as one lifecycle, start to finish.

The lifecycle, phase by phase

• Phase 1: read the instrument. Your GSA contract or order defines which systems are in play and invokes the process. The guidance tells you what the review will measure. It is built on NIST SP 800-171, and GSA's process was among the early movers to Rev. 3 and agency-defined ODP values. Read both documents before any engineering starts.
• Phase 2: scope and implement. Define the boundary, implement 800-171 at the specified baseline, and align ODP values to what GSA defines. The work runs through the same Factory stations as our other programs, with output shaped for GSA.
• Phase 3: clear the showstoppers first. GSA's process treats certain requirements as authorization-blocking. Sequence them first and the package keeps moving; leave them and it boomerangs back to you. The blocking items are known in advance, so you can plan the triage.
• Phase 4: the package. Assemble the SSP, POA&M, and objective-level evidence in the structure GSA reviewers expect. A package organized to the reviewer's checklist reads fast. One organized to your file system reads slowly, and slow reviews find problems.
• Phase 5: the authorization decision. A GSA authorizing official reviews and decides. Expect questions; the practitioners who built the environment should be the ones answering them.
• Phase 6: continuous monitoring. The decision starts an ongoing obligation: evidence refresh, change reporting, POA&M management, and periodic re-evaluation. Budget for that operating rhythm from day one, because it lasts as long as the authorization does.