Navigating the Clouds: Decoding FedRAMP with LaunchDarkly and Schellman | The Pair Program Ep49

In this episode of The Pair Program, we dive deep into the complexities of FedRAMP with two industry veterans who have navigated the process firsthand. Sara Mazer, Federal CTO at LaunchDarkly, and Nick Rundhaug, Managing Director at Schellman, join us to shed light on the FedRAMP authorization journey and offer valuable insights for companies seeking to achieve this prestigious certification.

FedRAMP, the Federal Risk and Authorization Management Program, is a critical framework managed by the GSA’s Program Management Office that ensures cloud services meet stringent security requirements before working with the government. LaunchDarkly’s successful FedRAMP authorization is a testament to their commitment to security and compliance, and Sara Mazer, who led the charge from start to finish, shares her experience and the challenges faced along the way.

In this episode, Sara and Nick discuss:

• What FedRAMP is and why it's crucial for Cloud companies working with the government.
• LaunchDarkly’s journey through the FedRAMP process and Sara’s role as the first technical team member.
• Insights into Schellman’s role as a Third-Party Assessment Organization (3PAO) and their partnership with LaunchDarkly.
• Tips and advice for companies aiming to achieve FedRAMP certification, including common misconceptions and the importance of preparation.
• Strategies for successful FedRAMP navigation, including the need for agency sponsors and leveraging readiness assessments.

Tune in to gain a comprehensive understanding of FedRAMP, learn from the experts, and discover practical advice to help your organization achieve cloud security certification.

Sign-Up for the Weekly hatchpad Newsletter: https://www.myhatchpad.com/newsletter/

Welcome to The Pair Program from hatchpad, the podcast that gives you

2

a front row seat to candid conversations

with tech leaders from the startup world.

3

I'm your host, Tim Winkler,

the creator of hatchpad.

4

And I'm your other host, Mike Gruen.

5

Join us each episode as we bring

together two guests to dissect topics

6

at the intersection of technology,

startups, and career growth.

7

Hey everyone, welcome

back to The Pair Program.

8

Tim Winkler here with Mike Gruen.

9

Uh, Mike, my wife is a big fan of these

National Calendar Day, uh, items, so.

10

You know what I'm talking about with that?

11

I mean, I know that there are

12

Mike Gruen: national calendar

days, but National days.

13

Yeah, but I don't know.

14

So every day

15

Tim Winkler: is some

national day to celebrate.

16

Is every day something?

17

Yeah, they've come up with

something for every day.

18

So for example, today

is national avocado day.

19

And, um, so I'm gonna

ask you an avocado guy.

20

Are you big, big guacamole

21

Mike Gruen: guy?

22

So I like avocados, but I'm

not a big guacamole guy.

23

Um, usually got too much

garlic in it for me.

24

And, uh, the garlic just

doesn't sit well with me.

25

So.

26

Um, it's not that I don't like

the taste of garlic, it's just

27

that it does bad things to me.

28

Tim Winkler: Yeah, so, so, F.

29

Mary, kill, uh, guac,

queso, guac, queso, salsa.

30

Oh, it's

31

Mike Gruen: Mary salsa, FK, so kill,

uh, kill the guac, kill the guac.

32

Okay.

33

We're going to make a little

sound bite of that for you.

34

Not at

35

Tim Winkler: all.

36

The most awkward beginning,

just awkward, awkward start.

37

Um, all right, we'll

transition from, from there.

38

Uh, I'm excited for today's episode.

39

So today we are kind of diving

into the world of government

40

compliance and cloud technology.

41

A special focus on FedRAMP.

42

So FedRAMP is short for the Federal Risk

and Authorization Management Program.

43

And joining us are two experts who

are pretty deeply entrenched in the

44

FedRAMP ecosystem from, uh, a couple

of different unique vantage points.

45

So first we have Sarah Maser, the

federal CTO at LaunchDarkly, a software

46

company specializing in feature

management for development teams.

47

Uh, also note that Sarah is a co

founder of the Federal Cloud Advisory

48

Board, uh, which is a non profit

dedicated to making the FedRAMP

49

authorization process easier for all.

50

Uh, and accompanying her is Nick, uh,

Runog, a managing director at Shellman.

51

A company providing compliance

and attestation services globally.

52

Nick's also an expert FedRAMP assessor.

53

Uh, and so together we're going to

explore what FedRAMP really means

54

for companies, kind of that intricate

journey of getting certified and why

55

this is crucial for any software provider

that's working with the U S government.

56

So Sarah, Nick, thank you both for

joining us today on the pair program.

57

Sara Mazer: Yeah.

58

Thank you for having us.

59

Of

60

Tim Winkler: course.

61

All right.

62

Now, before we dive in, we're going to

kick off with our pair me up segment.

63

Uh, here's where we all kind of

go around the room and spitball a

64

complimentary pairing of our choice.

65

Mike, you lead us off what,

what's your pairing for today?

66

So.

67

Mike Gruen: Again, try

and go back to some food.

68

Uh, I'm going with, um, tuna salad with

a hard boiled egg, uh, mixed into it.

69

And it's, uh, my grandmother used

to make it for me when I was a kid.

70

It's just like, it's just a favorite.

71

Um, toasted rye if you have to, or pita.

72

But, uh, but yeah, the, um, egg

salad and a hard boiled egg.

73

That's my pairing.

74

Oh, what do you say?

75

Tuna salad.

76

Oh, sorry.

77

Tuna salad.

78

Yes.

79

Tuna salad.

80

Yeah.

81

Yeah.

82

I had chicken salad for lunch.

83

That's what made me think of it.

84

Tim Winkler: Uh, I'm

right there with you, man.

85

Tuna.

86

Tuna salad's one of my go tos, but if you

don't have that hard boiled egg in there,

87

I feel like it's not a complete salad.

88

There you go.

89

Yeah.

90

Yeah, big, big, uh, hard boiled egg fan.

91

Awesome.

92

Cool.

93

Um, all right, I'm going

to deviate from food.

94

Uh, and this is just going to be

probably a pairing for myself.

95

Not, not many people will understand,

but I'm going to go with solo

96

parenting and documentaries.

97

Um, so last night my wife went out to

dinner with some of her, her girlfriends.

98

So I, I played the single dad.

99

Uh, you know, watching my daughter,

uh, Alice and we always have a great

100

time when I'm, when I'm, we're just

kind of one on one with each other.

101

So we did, we did dinner

and read some books.

102

And then when I put her down for, for

bed and it's just me, I always find

103

like, that's like the perfect time for

me to get locked into a documentary.

104

Documentaries, I feel like

you just, you got to be really

105

tuned in with no distractions.

106

Uh, so this is kind of like

my time to do just that.

107

So that's, that's my parent.

108

I got locked into a pretty wild one

on political conspiracies last night.

109

Um, I won't go too, too into detail

on it, but, uh, I'll shout it out.

110

It was called everything

is a rich man's trick.

111

Uh, and you can.

112

It was only finding on YouTube,

um, but, uh, went down this whole

113

Reddit rabbit hole to find, uh,

some interesting documentaries.

114

So Reddit's another one.

115

Reddit's another one.

116

You could probably pair Reddit with

some good conspiracy theories, but, uh,

117

that's my, that's my pairing for today.

118

Uh, let's kick it over to our

guest, uh, Sarah, about yourself,

119

quick intro and your pairing.

120

Sara Mazer: Yeah.

121

So, uh, you intro'd me just very well.

122

So I am the federal CTO of LaunchDarkly

and been with the company over four years.

123

I've taken the company through FedRAMP

authorization from the very beginning,

124

all the way through the end and continuous

monitoring and that sort of thing, uh,

125

looking at maybe doing it all over again.

126

So a lot of this is

really fresh in my mind.

127

Um, and then I would like

to say my pairing is.

128

A dog and another dog.

129

So I am an animal lover.

130

I rescued dogs.

131

I think that they're like potato chips.

132

You can't have one.

133

If you have one, it's not that

big of a deal to get another one.

134

So consider adoption

and their pack animals.

135

They love to just hang out in packs

and makes you feel less guilty

136

if you leave them at home alone.

137

So I think, uh, I'd like to just

shout out having multiple dogs.

138

Mike Gruen: We, uh, I grew up with

dogs, our dogs were outside dogs, uh,

139

and having, we always had at least

two, usually three, sometimes four,

140

uh, cause they're a pack animal and,

uh, they want to hang out together.

141

Awesome pairing.

142

Tim Winkler: I like the analogy of

the like potato chips can't have

143

just one that's that was creative.

144

We, we had two dogs, um,

for, for a few years.

145

We lost one, this guy, Griffin, uh,

behind me here, we had a little, little

146

painting, but we, we got, um, a puppy

when Griffin was about seven years old.

147

And I, I always found it really

helpful to have a, you know, a puppy

148

with a more mature dogs, it kind

of, they follow suit helps with

149

like training and stuff like that.

150

So, um, Well said, I think great

pairing, uh, all right, let's pack

151

it, pass it over to, uh, Nick, but

quick intro and, uh, your pairing.

152

Nick Rundaug: Yeah, thanks Tim.

153

Um, and like Sarah, uh, good, good

intro already, but, uh, Necronomic

154

Managing Director at Shulman.

155

Now our federal service line leader,

um, amongst others here, uh, for

156

pairings, um, as you can tell behind

me, I do enjoy some retro video games,

157

uh, video games with my daughter.

158

Um, she's 13 and of that, uh,

age and generation where they

159

like phones, they like games.

160

So it's a perfect way to connect.

161

Um, recently, uh, within the past

year or so she was playing Fortnite.

162

And I've never won a game.

163

Um, I pride myself on a lot of, uh, the

battle royales that I've won a game.

164

Number one, and she got

me my first win on there.

165

I think I killed, got one kill.

166

She had like eight, but I'll take it.

167

A win's a win's a win.

168

Uh, so yeah, video games and my daughter.

169

It's a good pairing.

170

Mike Gruen: Awesome.

171

That's a good pairing.

172

Tim Winkler: That's solid.

173

Does she play some of your

old school retro games?

174

And it's like, what, what am

I, what are we doing here?

175

Nick Rundaug: Absolutely.

176

Yeah.

177

She appreciates all of them.

178

Uh, and, and they've been good about

porting a lot of those to Switch.

179

So we do, we probably

play Switch more than.

180

More than PC games, but, um, yeah,

she, she does appreciate some of the

181

old ones at Mario's classic and time.

182

Yeah.

183

Tim Winkler: Yeah.

184

Nice.

185

Yeah.

186

Love the switch.

187

All right.

188

Uh, that's a, that's a wrap

on the pair me up segment.

189

So, um, let's go ahead and,

uh, transition into the, the

190

heart of our discussion here.

191

So, as I mentioned, we're going to be

talking about fed ramp, uh, and covering,

192

you know, like the definition of, of

fed ramp, the certification process.

193

Um, some of the associated cost

challenges and advice for companies

194

that are considering the process.

195

Uh, so in true pair program form,

we're going to be able to approach

196

this from both sides of the coin.

197

Sarah, taking the perspective

of a company getting certified.

198

Uh, Nick, with the perspective of,

uh, a three PAO or a third party

199

assessment organization, uh, working

with a company getting certified.

200

So let's, let's dive into it.

201

Sarah, how about you maybe kick us off

with an explanation more on what FedRAMP

202

is and its significance to companies?

203

Sara Mazer: Sure.

204

So FedRAMP is an authorization

program that is managed out of the

205

GSA's program management office.

206

So GSA for short.

207

And it is a way that companies such

as LaunchDarkly or other providers

208

that have something to do with the

cloud are able to get authorization

209

to work with government agencies.

210

Theoretically, it makes it

easier for government agencies

211

to purchase your software.

212

It means that your software has

been vetted as More secure than

213

it otherwise would have been.

214

So it means that you're compliant

with certain government regulations.

215

And the goal on the government

side is really to share that work.

216

So instead of every single agency

going through and vetting, A CSP or

217

cloud service provider, which we are,

um, and making sure that it's secure

218

and it means certain regulations.

219

Now you have one organization that

standardizes that practice and all

220

the government agencies can kind

of take advantage of the work of

221

maybe your sponsor or the job in the

past, there was a job and, and then.

222

That work can be shared amongst all

agencies and it makes it easier and cause

223

it saves costs for the agencies as well.

224

Tim Winkler: Awesome.

225

Can, um, so before we pass it over

to Nick, can you tell us a little bit

226

more about your launch dark, please?

227

Like evaluation and

initiation into FedRAMP.

228

Sara Mazer: Yeah.

229

So it took us some time to

actually go through that process.

230

There's a lot that happens

upfront, even before we start

231

working with somebody like a 3PAO.

232

And that is, do we even

want to make that effort?

233

And so there's analysis of looking

at your pipeline, looking at your

234

product, trying to figure out how much

change would need to happen and putting

235

together a proposal for the board.

236

And so there's a lot of work that

goes into it before you even start

237

talking to 3PALS or the GSA on whether

or not you're going to go through it.

238

And then once you start talking.

239

To the PMO, they expect you to pretty

much do everything in about a year.

240

So start to finish for LaunchDarkly,

it was about three years.

241

Uh, but starting from the point of

working with the GSA on forward,

242

that was just over a year.

243

Tim Winkler: And maybe for some

helpful context, what's the size of

244

LaunchDarkly or what was the size

of it to like when you all first

245

started going down the process?

246

Sara Mazer: So we were

about 500 employees.

247

And we are fully SAS.

248

We run in the cloud and

require cloud components.

249

We did have a on prem version, which

means that we're actually running at

250

another government agency's cloud.

251

So we started.

252

We started with a little bit

of an advantage and that we, we

253

knew what kind of regulations

we had to comply with already.

254

So we had an idea of the level of work

for creating a federal instance that

255

some companies may not be able to take

advantage of, but, uh, yeah, so we already

256

had a couple of different versions of

lunch darkly running in different places.

257

And the decision was, do we want to

migrate over to a federal instance?

258

Where we can then bring on other

government agencies at that time.

259

Tim Winkler: And your background

specifically, maybe it's, it's helpful

260

to paint the picture of where you kind

of came from and where you specifically

261

brought on, uh, to the team at

LaunchDarkly with this initiative in

262

mind, or was there other areas that

you were satisfying and then this kind

263

of came onto the, onto your plate?

264

Sara Mazer: So we were a small team

at the time and I came in as the

265

first, uh, Technical, uh, expert for

the federal team at lunch darkly.

266

And at the time we were

not considering FedRAMP.

267

So I had worked with the

accounting executive to start

268

building a case for FedRAMP.

269

So it wasn't a done deal.

270

We had to go and convince the board.

271

We had to look at the pipeline.

272

We had to look at all the companies

that have approached us in the past

273

and look at the deals lost because

we weren't FedRAMP authorized.

274

And so I started with that AE

from day one to build a case

275

and it, it did take some time.

276

Tim Winkler: And then when you were going

through selecting these different vendors,

277

you know, what is it, what was it that

you were kind of looking into, or maybe

278

some of these challenges that you ran into

when you were kind of deciding or vetting

279

through some of these three PAO firms?

280

Sara Mazer: Yeah, I, I have a

whole bunch to say on lessons

281

learned and best practices that

I'm sure we're gonna get into.

282

I think at the time though, our

company was so new to FedRAMP

283

in general, I was new to it.

284

It was a learning

experience for everybody.

285

So I think, you know, we, we knew the

process, we knew about the timeline.

286

We knew a little bit about the product.

287

We didn't know much about the three PAOs.

288

Um, and so vetting them was at the time

just talking to them and getting prices

289

and figuring out how long it will take

and their expertise on, you know, taking

290

companies through that and um, and now

looking back and trying to decide if we're

291

going to go through this all over again.

292

There's, there's so many

lessons learned there.

293

Um, I think we did a decent job, but

there's always room for improvement

294

and that's what I wanted to do when

a few of us got together in industry

295

to start the federal plant advisory

board, because there's really wasn't

296

anybody to go call up and say,

Hey, you went through this before.

297

Who should we hire?

298

Why?

299

You know, tell me some horror

stories or give me invite.

300

There wasn't any of that for

like the smaller and size CSPs.

301

So a bunch of us through LinkedIn

met and got together, and there

302

were four co founders at the time

to kind of help each other out.

303

We were all in different stages of going

through federal authorization, but it

304

was such a painful procedure that we all

just want to help each other out now.

305

And so we have that nonprofit that

we started to kind of hold other

306

people's hands and give them advice.

307

And And, um, we're very blunt internally

about, you know, who's, who's a

308

good three PAO and who's not, and

here's why, and, and talking about

309

all the issues and change that are

going on at the GSA office right now.

310

Tim Winkler: That's great.

311

It's what, this seems like a very

helpful, uh, organization to.

312

To, to identify with when you're going

through the process and we'll be sure

313

to, uh, shout out all the, the terrible

three PAs on this podcast as well,

314

uh, but no, it's, it's, it's sound.

315

Let's talk about a good one.

316

So you had a good experience here

with, with Shaman and Nick, let's

317

pass it over to you at this point.

318

Um, maybe start with, you

know, a little bit more of.

319

Overview on like, you know, Shelman, how

you all operate as as an organization,

320

and then, um, uh, maybe a little bit

more detail into, you know, coming to

321

three PAO and, and then how you all kind

of got intertwined with LaunchDarkly.

322

Nick Rundaug: Yeah, no, absolutely.

323

Um, one of the terms that, that you

hear a lot is three three PAO three pal,

324

uh, third party assessment organization

and, you know, a critical piece of

325

the FedRAMP process because the third

party portion of that, um, prior.

326

It'd be FISMA reports, and we just go

right to the federal agency using it.

327

Um, that's, that's good.

328

It works on a small scale.

329

So, FedRAMP is leverageable, so

it's scalable, meaning you get that

330

one report, and it can go to as

many authorizations as, um, federal

331

agencies want to use their product.

332

So, LaunchDarkly, They can have multiple

authorizations now, one report, so it

333

saved time and money on everyone's side.

334

Um, the third party part comes

into play because now someone

335

else who's independent comes in.

336

It's not a self assessment, um, by

the cloud service provider, so by and

337

large, it's not the federal agency

that might not have the expertise.

338

So third party, that's us, um, uh, for

FedRAMP, three PAOs are accredited.

339

So there's a short list and shockingly

over the years, it's only gotten shorter.

340

So, um, that list, if you really go on

there and it's all, it's all public, go

341

on the marketplace and take a look, that

list has gotten shorter over the years.

342

Um, because there's an

accreditation process to it.

343

So A2LA is an organization

that comes through and kind of

344

audits the auditor, so to speak.

345

So on a yearly basis, they check

us, check our work and all that.

346

Um, that's how one becomes a 3PAO.

347

So Shellman, um, starting as a, an

accounting firm, uh, doing non finance,

348

we focus on security assessments.

349

Uh, saw this as a, as a, you know, a

market that is developing and we got

350

our, um, accreditation and have been

one of the first, uh, to, to do that.

351

So we've grown over the years.

352

Um, We, you have a choice and

you can be, um, have consulting

353

advising services as well, or you

could be pure play assessment.

354

We are pretty much the only one on that

list that's pure play assessment only.

355

We don't offer consulting advising.

356

Um, that's helped us expand quite a bit in

that, um, FedRAMP prohibits you from ever.

357

Doing work and assessing your own work.

358

Um, so that's one of those things that

when folks are looking, looking at

359

those that they have to kind of make

that decision to want one or the other.

360

Um, it's made us have that expertise

specifically on assessing and so

361

our assessors get very good at

particularly FedRAMP assessing.

362

So that's why you've seen the,

uh, the growth in those numbers

363

or anyone that has seen that.

364

Um, That comes through on

the on the marketplace.

365

So that's how we kind

of got in that business.

366

And, um, we've expanded that quite a bit.

367

And now we're the one in the marketplace,

probably for one of those reasons, there

368

is a pen test portion of that as well.

369

So we also not only do we have

assessors part of our assessment team.

370

Are penetration testers as well

as FedRAMP does require that.

371

So it's kind of an all encompassing thing.

372

Um, that's what every three

PAO that you're hearing does.

373

Um, and that that's what we do.

374

We got introduced, um, launch darkly.

375

I believe I remember correctly was

kind of looking around at assessors.

376

We did not do their initial assessment,

but they were looking at, um, changing.

377

So we spoke with them, um, kind of

talked through how we would do things.

378

Um, any, any, uh, Thing that they want

to see differently how we would address

379

that and see if there's a right fit.

380

It was, and we've continued

to do their annual assessment.

381

From then on out and with fed ramp.

382

That's kind of the other piece

that was put into place when

383

the program is developed is.

384

It wasn't a 1 time report.

385

There's a continuous monitoring aspect.

386

Part of that umbrella

continuous monitoring.

387

Is an annual report that has to be done

by a 3rd party assessment organization.

388

So we come in and check

them on an annual basis.

389

Thanks.

390

Um, and look at all sorts of stuff,

but we basically look at a subset

391

of controls every single year.

392

Mike Gruen: I think 1 of the things

that you touched on it, but I think it's

393

important to point out is the fact that

there's that separation between doing

394

the work and assessing the work, having

gone through any number of assessments

395

for various things over the years.

396

There was always there were there's

plenty of certifications you can get where

397

the company that's doing the assessment

is also the one that's helping you and

398

miraculously they have a 100 percent

success rate if you just pay them.

399

Um, so, um, so I like that about FedRAMP.

400

I, um, Like from my perspective,

I at one of the companies I

401

started the process, I left that

company before we sort of did it.

402

But we went, we started going

through the whole FedRAMP, um, like

403

looking at it and assessing it.

404

And we didn't get to the point where I

got to pick an assessor, but, um, did get

405

through like, so there is a lot of tools.

406

I think, um, Sarah, back to your point

of like, there's a lot of tools you can

407

use To do pre assessment and early stuff

to sort of get an idea of how much work

408

this is going to be, because that's when

you're talking about, you know, like going

409

to the board and getting approval, not

only do you need to know what the pipeline

410

is, but you also have to have some

concept of what the cost is going to be.

411

Um, so, um, so I've gone through a little

bit of it, but not the whole thing,

412

but, uh, I did, I was, I'll wrap it up.

413

I was, uh, happy to see that the, the,

they keep it separated, that you can't

414

do the work and assess your own work.

415

Oh, that's cool.

416

Tim Winkler: Let's, let's dive

deeper into the cost of it.

417

Um, I'd love to, you know, try to get as

transparent as possible for some of those.

418

Folks out there that

might be considering this.

419

So, um, yeah, Nick, what, what are some

of the typical assessment calls for

420

companies wanting to become certified?

421

Nick Rundaug: Yeah.

422

And we can kind of break it down

really into there's everything

423

before the assessment, um, Sarah's

probably gonna come in on that.

424

Uh, so there's architecting, right.

425

Standing it up.

426

Um, and all of that is, uh, possibly

consulting, advising work that goes

427

into that, getting someone's expert

expertise as to, Hey, what is fits

428

140 dash two or dash three mean?

429

And what are the current

modules that do that?

430

That's all that pre work, right?

431

Then there's the assessment

piece, that's us.

432

There is an ongoing piece after that

that's worth mentioning, we have a

433

part of that, but, um, it's, it's

always good to, to recognize that a

434

CSP is going to have regular costs

probably as part of that, right?

435

Like, there's, there's increased scanning

requirements, there's certain logging and

436

instance response, and all that does come

with a cost, um, that Sarah will probably

437

be able to answer better than I can.

438

As for actual assessment costs,

um, it's it's fairly transparent.

439

It's a level of effort thing.

440

Um, it is The, uh, as an assessment

firm, it is the most expensive, most

441

expansive, uh, most, uh, technically,

um, you know, uh, complicated assessment.

442

We do most of the time.

443

That means we, um, have a pre period

where, um, there's some deliverables

444

federal requires like a SAP security

assessment plan, and then the actual

445

SAR package security assessment report.

446

All of that kind of gets bundled in as

well as with a pen test, penetration test.

447

Uh, up to six vectors that includes

everything inside that bubble of a

448

boundary and, and, uh, any mobile apps

and other type of things they want to

449

authorize all that means we know the

number of weeks and a lot of times

450

just comes out to number of weeks as

well as that kind of review afterwards,

451

a standard, um, as of 2024, a, uh,

moderate initial assessment, 260,

452

000 is about what it costs a quarter

mail ballpark right on in there.

453

That's just that assessment

piece on an annual basis.

454

Think around 200.

455

Um, other costs that can come into

play from an assessor is if you have

456

changes that are ad hoc throughout

the year, those have to be tested.

457

So, once again, level of effort on

number of weeks and if a pen test,

458

but those are some ballpark pricing

just on the assessment piece.

459

But then you take that and add it to, uh,

throw it over to Sarah on probably what

460

a lot of that cost is rolling up to that.

461

Um, and it goes up quite a bit.

462

Tim Winkler: Yeah, Sarah, what

kind of additional cost, uh, kind

463

of came into play on, on your end?

464

Sara Mazer: It's interesting because I was

just looking at the numbers because we're

465

trying to figure out where we go next.

466

And we look back at the ROI of

the better at moderate instance.

467

And I looked at how we were doing

accounting for that federal instance.

468

And, um, it was, it was pretty interesting

cause that's not necessarily my world.

469

Um, I would say, you know, it

really depends on your product

470

and the company and Where you're

at in the process, how much it's

471

going to be, um, for lunch darkly.

472

I, I think it's safe to say that, you

know, it's over seven figures to do

473

the whole thing that includes a lot of,

you know, infrastructure costs because

474

you're standing up a completely new

instance and some other region of Amazon.

475

And.

476

It also includes product changes, so

there's going to be engineering effort to

477

swap out components of your architecture

with things that are FedRAMPable.

478

So there are, and so that's going

to differ from company to company.

479

Not everything is bedrampable, so

you have to then figure out, like

480

CDNs are a good example, right?

481

There's, you know, our commercial instance

uses Fastly and they're not bedramped.

482

So then what do we do, right?

483

And so there's all these

decisions that you have to make.

484

And so there's the engineering hours just

to change the architecture, which then

485

are people hours, plus you're buying new

software, new components, potentially.

486

Right.

487

And then there's compliance costs.

488

So there's all the way down to the

operating system level where we

489

switch to like canonicals, BIPs.

490

Um, bunch of pro, which is, you know,

fed rampable because it has got the

491

encryption in a, um, all the way up

to like higher level, um, types of

492

services that we take advantage of.

493

So, you know, that, that whole across

the board from really low level to higher

494

level components that may need to be

replaced and then on the flip side, it's

495

not really cost, but you could lose.

496

Capabilities in your product, and does

that hurt your market share because

497

you don't have all the capabilities

your commercial version does because

498

things just can't be compliant

with FedRAMP as things stand today.

499

And so there's kind of that

loss that doesn't show up on,

500

you know, the P& L sheets.

501

For it, but it certainly plays a factor

in the decision of whether somebody

502

would want to go through FedRAMP or not.

503

So, and then just the general, as Nick

mentioned, you know, the Kanban meetings,

504

all the paperwork that you have to go

through all the time, a significant change

505

or class that all takes time and eats

up engineering and security team hours.

506

So it does end up being pretty

significant for all of the CSPs.

507

Mike Gruen: I'm curious, did you, um,

have like a separate team that was sort

508

of responsible for this or was it just

part of broad engineering responsibility

509

to maintain essentially both versions?

510

I'm just sort of curious.

511

And did you experiment with both?

512

What was sort of your experience?

513

Sara Mazer: We kind of had a

tiger team that did the migration.

514

So we did take it, our instance that was

posted at a federal agency and move it.

515

And so the tiger team were the

experts in the migration effort.

516

But right now, all of engineering is

expected to be able to understand the

517

federal instance and go in and, uh, and

deal with incidents and all of that.

518

There's another component, which we

made the decision at the time not

519

to do, but it's whether you should

run in a GovCloud region or not.

520

That's independent of FedRAMP and

you have to look at your pipeline

521

and your potential customers

to be able to make that call.

522

Um, but that is another change where

then maybe you do have to start isolating

523

out who's going to work on the federal

instance because they have to be U.

524

S.

525

citizens and so all the way from support

personnel to, uh, security to developers.

526

And so That's another organizational

change that you might have to

527

think about if you're going to go

through and install in GovCloud.

528

Tim Winkler: Yeah.

529

I mean, I think you were saying in the,

in those early stages, when you're kind

530

of got getting the key stakeholders

and onboard with this, you know,

531

you're probably really looking at that

opportunity pipeline, you know, some

532

of those opportunities that you lost

out on, uh, yeah, one or two of those.

533

It's an easy justify the cost of.

534

You know, this type of implementation

and the value add there.

535

So, um, yeah, it's, it's, you know,

it's not a drop in the bucket and, and

536

I, this is kind of leads me to another

question too, is, you know, um, you know,

537

there's this list of assessors, these,

these three pals that you all reference.

538

Um, is it pretty standard

pricing across the board or is

539

there, you know, uh, I guess you

mentioned level of effort, right?

540

So if it's a smaller organization,

do you find that the cost is

541

going to fluctuate, um, you know,

based on the size of that org?

542

Nick Rundaug: I can

answer, I can answer first.

543

Um, a lot of times we don't entirely

know, um, you know, what, what, uh,

544

our competitors are charging, but, but

we do hear quite a bit, you know, um,

545

We'll be higher than than quite a few.

546

But once again, um, a decision we

made on on talent retention, focusing

547

on that and hoping that that that

comes through, um, it's also several

548

different models that folks have.

549

I know we we approach things and try

and provide value that way going.

550

It's not going over that.

551

And others will kind of take a different

approach and go, well, we'll charge you

552

for support meetings and things like that.

553

Whereas, um, we'd rather, um, folks kind

of know that going in, but prices, I,

554

I would be, um, surprised, especially

because when I said that shrunk, a lot

555

of them could not find a model at work.

556

So, you know, we've been doing this a

557

I think.

558

You know, we're doing it close

to the beginning of that.

559

So, um, that list that was

well over 100 or maybe approach

560

100, but it's quite a bit.

561

Um, it's down to really, in my opinion,

about 30 active, of which, um, only

562

about 10 of those have double digits.

563

So, um, some of those

pricing models that were.

564

Very low.

565

Uh, I think to try and get the

foot in the door have gone away.

566

So, um, they're probably all within

about the same, um, certain percentage,

567

maybe 20%, I know that's a pretty

big percentage, but, um, yeah.

568

And then I'm not sure Sarah

has any insight there as well.

569

Sara Mazer: I do.

570

Since I talked to quite a few of them

and we got quotes from a bunch, maybe

571

this is a good time where I could go

over, um, my list of tips for vetting.

572

Tim Winkler: Yeah.

573

Sara Mazer: But for, uh, so.

574

I'll start out with saying that

price should be really on the

575

bottom of your list, right?

576

So they're all somewhat in

the same ballpark and it

577

really matters who you choose.

578

The first thing that you should do

is ask other people, their experience

579

of working with companies and there

are now organizations such as my

580

nonprofit, but there are others.

581

But it's really, really important to

get feedback on which are good and which

582

aren't, because there are some that are

pretty well known to be not so good.

583

And some that are.

584

You know, there's, there's about

four of them in my mind that I've

585

heard nothing but positive things.

586

And you know, another tricky

thing is people move around too.

587

So it doesn't matter.

588

It's like, who is the

person doing the work?

589

It's not just the sales guy

that's giving you the quote.

590

Um, you really need to make sure

that they have a good team of people

591

that know what they're doing and

retention is really important.

592

Some of them have a lot more turnover,

and so you don't know that unless you

593

talk to others in the industry that

have potentially gone through this, but

594

that's the first thing is really just

do background checks on them and reach

595

out to people that have gone through it.

596

I think almost everybody that has gone

through the process, if you even find them

597

on LinkedIn and say, Hey, I just have a

few questions, they'd be more than happy.

598

To tell you their experience because

it's, it's such a painful procedure,

599

but there's other things that you

might want to consider, um, related

600

to, uh, whether they've got experience

with companies in your space.

601

So they may not have experience with a

company that does exactly what you do.

602

It may be on the database side, or it

may be on, you know, the, the higher

603

level, uh, software as a service side

that's, you know, fully application based.

604

And so somebody that has a little

bit of an experience and, and what

605

you do or understands your industry

and our space is really important.

606

Um, and I would say also they understand

the agency that you've worked with and

607

they've got authorizations with the, uh,

sponsoring agency because, for example,

608

CMS is our sponsoring agency and on top

of the FedRAMP regulations, they've got

609

something called ARS, A R S, um, that are

additional compliance regulations that

610

we have to adhere to to get that ATO.

611

So if your assessor knows that

and is familiar with that, then it

612

just makes it a little bit easier.

613

Thanks.

614

And then there's the

contracting side as well.

615

So you want to make sure that if you

contract with one, that you want to

616

ask for some way to do weekly status

updates or monitor their progress.

617

Um, because we've seen issues with other

three POs where they're, they could just

618

go radio silent or things get delayed

and you want to stay on top of it and you

619

want to put that right in your contract.

620

Another one, I was like an

early termination class.

621

Um, sad to say that that does happen

sometimes is that, uh, for whatever reason

622

you want to get out of your contract

and work with a different 3PO, um, you

623

want to make sure that you have the

right clauses in, you know, up front and

624

you've thought of that ahead of time.

625

And then I also think in terms of going

back to pricing, there are companies

626

out there that offer FedRAMP in a box.

627

And And they do a similar thing, right?

628

And they, they kind of promise that

you'll go through a FedRAMP authorization

629

and some of them help you do 3PO work.

630

Um, but then it kind of limits

the architecture and limits the

631

control that you have in making

changes to your architecture.

632

So there are a lot of trade offs there.

633

So the prices on those are not apples

to oranges and those, but you want to

634

be very wary of the FedRAMP in the box.

635

Type of, um, services out there.

636

And my experience, uh, some of them are,

you know, have had really good positive

637

customer, um, outcomes, but other ones

that I've heard frustration from as well.

638

Nick Rundaug: Yeah.

639

Uh, well said Tara on all those points.

640

I, uh, the one key thing that she

said, I think is very important.

641

I always say, if, if, you

know, You get on a sales call,

642

people can tell you anything.

643

How do you know they're lying?

644

Go on that marketplace.

645

The cool thing FedRAMP did, they

made all that information public.

646

Reach out to one of those

that is a client, pick

647

randomly, pick randomly, right?

648

And see what they say.

649

Like, that's a true test right there.

650

Uh, and say, Hey, how was your experience?

651

I put a lot of stock behind that and

think that, um, everyone should do that.

652

Mike Gruen: Yeah, that's

awesome advice in 20.

653

So I, when I was going

654

Uh, it wasn't a lot of people to talk to.

655

There were a lot of companies offering

that there are a lot of, and it was the

656

way we got hooked up with the company

that I think we ultimately ended up using.

657

Um, it was, it was all just

connections, people knew people

658

and they're, and they really pushed

hard on how well connected they were

659

with the agency we were going with.

660

And I don't know, I never

really felt great about them.

661

I'm not going to throw any shade, but

I'd be surprised if they're still around,

662

but it is, it's nice to hear

though, that, I mean, that is

663

part of it is that relationship

is important that they understand.

664

Um, so maybe, maybe my read on that

situation was, was a little off.

665

Maybe that was an important aspect

that I, uh, didn't pick up on.

666

Um, but yeah, those are

really helpful tips.

667

Tim Winkler: Yeah.

668

Super helpful on the, on

the three PAO vetting.

669

And I guess to kind of put a bow on the,

on the discussion at large, any advice

670

for just companies considering FedRAMP at

large, like the when and the why that you

671

would, Just want to point out and closing.

672

Nick Rundaug: Yeah, I can, I can start.

673

Um, we, we get a surprisingly large

amount of CSPs, cloud service providers

674

that come to us, find us first.

675

They're actually probably looking

for consultants, advisors.

676

Um, and then we also see through

that and those initial kind of steps

677

of as well as the actual assessment

and we see a lot of items that stop.

678

You know, kind of a

showstopper or cause issues.

679

Um, one is just kind of what Sarah is

saying is just get familiar with it.

680

You know, a lot, a lot of that, that stuff

is out there, um, on the FedRAMP website.

681

There's a lot that's not right.

682

A lot of the guidance that's, that's

missing and you have to kind of learn

683

it, but there's a lot that's out

there that shockingly, Folks just

684

don't know even though it's ready.

685

It's ready there.

686

So, um, there's a thing called a

readiness assessment report and it's,

687

uh, the templates are out there.

688

So is the system security

plan template within that is

689

essentially an open book test.

690

Everything you need to do is out there.

691

There's items that they've even

designated mandates, right?

692

So encryption, it's 140 2, 140 3,

as well as scanning requirements.

693

Those are the two biggest issues that

we run into as far as the technical

694

implementations that cause a delay.

695

And time is money, right?

696

Because you want those federal

contracts, the quicker you can get

697

them, the quicker this pays off and

your return investment comes through.

698

So, focusing on that early and building

it and architecting it into the

699

system early is absolutely critical.

700

So, being familiar with those

requirements and distilling them down

701

to the technical requirements and

the mechanisms you can do to employ.

702

Um, Huge pride, pride.

703

Number one thing.

704

I think that, um, I think, uh,

CSPs could do early with their

705

engineers is just plan for that.

706

No, they have to do it and

get familiar with those.

707

Mike Gruen: It's funny that

sorry, just to jump in.

708

It's funny that you mentioned the

encryption 1 because that was 1

709

that when we were doing our self

assessment, we're doing all of the

710

readiness and bubble on all the scans.

711

Our, it came back that our, well, we

were using one that wasn't compliant,

712

but it was actually higher that like

we were doing more than what was in

713

the standard and that tripped us up

a lot because it was like, how do,

714

how are we going to navigate this?

715

We weren't really sure.

716

And, uh, eventually we figured it

all out, but it's, it's these weird

717

things that you don't even, you

think, Oh yeah, we're, we're great.

718

We're fine.

719

And then it's like, Oh

no, actually you're not.

720

And

721

Nick Rundaug: the

722

Tim Winkler: scanning, I mean,

723

Nick Rundaug: there's requirements on,

you know, CVS is three Oh scoring and

724

a high has to be remedied in 30 days.

725

That's hard to do on a re

you know, and repeat that.

726

So knowing that ahead of time, get your

teams ready, having a few practice months.

727

Looking at your DNSSEC, making sure it

has all those parameters in there that

728

you don't wait till the last minute

because sometimes that can take months to

729

deploy and that's an item that you have

to have in place in order to proceed.

730

So there's these gates in place.

731

So, yeah.

732

Tim Winkler: Yeah, really helpful.

733

Sarah, anything that

you would add to that?

734

Sara Mazer: Oh, absolutely.

735

I have a lot of advice is the first

thing I'd advise on is finding an

736

advisor, somebody who has before maybe

a fractional CTO, somebody out there

737

that's just a mentor, somebody that

you can ask questions to, there's

738

a lot of changes that are going on

right now in the FedRAMP office.

739

The OMB wrote a draft memo on October

23 and they just updated it for,

740

um, I think on the 26th of July for

changes to the FedRAMP program, one

741

of which is removing the JAB, which

is the DOD side of authorization.

742

So, what that means is, The FedRAMP office

is a little bit overwhelmed right now.

743

So it is possible to get

FedRAMP authorized, but it's

744

going to take even longer.

745

So just finding somebody who's kind of

connected to that world to be able to

746

figure out how to take advantage of the

situation or get to the front of the line

747

or get advice on how to work with the

PMO is really critical, but then there's

748

like internal advice that I have as well.

749

Which just you need to learn how

to set the appropriate expectations

750

with your own executive leadership

and board that can cause a lot of

751

friction if everybody's not aligned.

752

And there's always friction between

sales and engineering or security, but

753

it just seems to increase when you're

talking FedRAMP and there's a lot

754

of money that's been invested and at

stake and you've got customers waiting.

755

So learning how to set those

expectations and that's where an

756

advisor could potentially help.

757

Um, that's really going to get you

going like out of the gate really

758

well, uh, in a good position.

759

But then also looking at the market

fit of your product, like, do

760

you even really want to do that?

761

Do you want to target

civilian agencies over DOD?

762

Maybe FedRAMP isn't the way to go.

763

Maybe you want to go right to DOD

and do something that's more on prem

764

and focus on their impact level, uh,

accreditations instead of FedRAMP.

765

There's a lot of pros and cons, and that's

what we talk a lot about internally, as

766

well as the Federal Cloud Advisory Board.

767

Um, not everybody is, uh, seeing

ROI on FedRAMP, to be honest.

768

Don't assume that if you

build it, people will come.

769

There are people, if you go on the

marketplace and you see they're

770

in FedRAMP ready stage, they've

been there a while and they have

771

not found a sponsoring agency.

772

And with the removal of the jab, now

you really do need an agency sponsor.

773

And a lot of agencies are being

asked to sponsor and they're

774

kind of overwhelmed as well.

775

And it's much harder to find a sponsor.

776

So you need to make sure that

you've really got that down.

777

And you found a sponsor.

778

You're pretty sure you're going to get a

sponsor before you think about investing

779

such a huge amount of money into.

780

Yeah,

781

Tim Winkler: it's really sound feedback.

782

And I love the, like the fractional, you

know, CTO concept, you know, a lot of

783

the listeners from our community are.

784

Startups are, you know, very

small businesses, right?

785

Where, you know, it costs is

everything in a lot of ways.

786

And the idea of biting off more than

you can chew before, uh, really getting

787

a good picture and make it a little

bit more of an investment up front

788

with a fractional CTO to give you

some, some guidance and advisor or

789

some sort of a mentor in that space.

790

I think that's, that's fantastic.

791

Uh, fantastic idea and great feedback

for a company that's either short on a

792

runway or what have you, when it comes to.

793

You know, expenses.

794

So, um, Yeah, really, really great Intel.

795

All right.

796

Well, I think, uh, that kind of, uh,

puts a wrap on, on the main discussion.

797

So we're going to pivot to our final

segment, uh, the five second scramble.

798

Uh, we're just going to do a little

bit of a rapid fire Q and a, um, some

799

business, some, some personal, not,

we're not getting too personal here.

800

Uh, Mikey, why don't you lead us off with

Nick and then I will, uh, get to Sarah.

801

Sounds good.

802

Mike Gruen: All right.

803

And also, these questions are going

to be different for both of you.

804

So, Sarah, don't bother.

805

I mean, some of them might might repeat,

but no, no, no need to take notes.

806

All right, so here we go.

807

What's the most common

misconception about FedRAMP?

808

Nick Rundaug: Common

misconception about FedRAMP?

809

Um, I think It would probably be on,

uh, sponsors and, uh, kind of a lot to

810

what Sarah just said, but, um, that if

you build it, that you'll, they'll come.

811

Um, finding a sponsor is

one of the hardest things

812

that, that CSP seem to have.

813

And, um, luckily there has been a little

bit of traction of FedRAMP is coming

814

up with, uh, kind of a job replacement

as well as DOD on their own, and, uh,

815

Issued a memo where there's a FedRAMP

equivalency for contractors, um, so

816

that they can, uh, go that route if

they don't have a sponsor, but their,

817

their products being used by actual,

you know, contractor to subcontractor.

818

So, we just, we've been hearing a lot,

819

sponsors, like Sarah was saying,

I think a lot of the sponsors out

820

there, they're kind of at the limit.

821

And bedroom kind of needs to address

that because you have a bunch of kind of

822

a top five, in my opinion, of sponsors,

and they got a lot that they sponsor.

823

So that's a lot of check

ins they have to do.

824

And I think they're a little overwhelmed.

825

So I think the 1 of big misconceptions

is that it is easy to find it

826

if your product is that good.

827

And that's not always the case.

828

Sometimes it's first to market.

829

Mike Gruen: Uh, what's your favorite

type of, uh, CSP to work with?

830

Ooh,

831

Nick Rundaug: man.

832

Um, I've actually worked with

quite a bit of, yeah, the, the

833

ones that upload evidence early.

834

How about that?

835

Tim Winkler: I

836

Nick Rundaug: love it.

837

But, but, but yeah, but yeah, Sarah,

they, um, if we can get onsite and, uh,

838

or onsite, uh, we start our interview

portion, which is like the, kind of

839

the main, main portion we're going

through all those 18 control families.

840

And we have, I mean, I'll

say even approach it 70%.

841

I'd love a hundred percent centers.

842

Those are my favorite ones.

843

Cause we will finish likely on time

and, uh, everyone will be happy.

844

So, uh,

845

Mike Gruen: what's the best piece

of advice you've ever been given?

846

Nick Rundaug: Oh, man.

847

Um, Uh, a quote from Bruce Lee and, and

it was, uh, to hell with opportunity.

848

I create my own opportunity, um,

to, to just essentially to just

849

go in and do it yourself, right?

850

Like go in, like open a NIST

special pub, read the whole thing,

851

go and figure it out yourself.

852

Don't, you don't have to rely on

other people to give you that answer.

853

Answers are out there.

854

Uh, experience is out there.

855

Everything's out there.

856

Just go find it,

857

Mike Gruen: you know?

858

Awesome.

859

Uh, what problems is Shellman solving?

860

Uh, we

861

Nick Rundaug: single single

source for all assessments.

862

Uh, really, uh, trying, trying

to make it easier for folks to

863

just reduce that audit fatigue.

864

I hear it all the time.

865

Right?

866

We're constantly in

assessments that we can.

867

We can make it and work with you

to make it to submit 1 piece of

868

evidence, and we can look at it

for all your different frameworks.

869

That's that's where a lot of that

value comes in along with, um.

870

You know, same people that

just same faces every year.

871

Mike Gruen: Uh, favorite company value,

872

uh, say what's your favorite company

value, like value that we have.

873

Yeah.

874

Cultural value.

875

Yeah.

876

Nick Rundaug: Yeah.

877

Yeah.

878

I mean, uh, I think investing in

your people, like a company is it's

879

people that that's the product, right?

880

Is, um, you know, there, there

is, there is always technology

881

before professional services.

882

It's the people, um, are going glass door.

883

You'll see really high ratings for us.

884

And I think that's reflected

like investing in the people that

885

they stay develop that expertise.

886

Uh, good leadership means that

it flows down, down to the

887

assessor all the way to the top.

888

And, uh, uh, company reflects that,

uh, what was your dream job as a kid?

889

Oh, man, I think I wanted to

be a, a chef or a ninja, but

890

I don't think ninjas pay well.

891

Um, so, uh, uh, I, I don't cook

at all, but I think that was it.

892

I think it was chef

893

Mike Gruen: something with knives.

894

What's the large speaking of what's

the largest land animal you think

895

you could take in a street fight?

896

No weapons, just bare hands

897

Nick Rundaug: and I'll probably just

a dog, but man, not too big of a dog.

898

I see that some of those, those

pit bulls are like pure muscle.

899

I don't know.

900

I could take out pit bull, but

you know, a smallish dog, maybe

901

bring it back to that pairing.

902

Okay.

903

Uh, I hope I don't have to test

it out, but I used to run a lot

904

and I remember being chased.

905

I can outrun dogs at a certain amount

of distance, but they're close enough.

906

No way.

907

Mike Gruen: Um, what's something you

love to do, but are really bad at?

908

Nick Rundaug: Oh yeah.

909

Some of the, some of the, I

love, I'm a big video gamer.

910

So some of the new, new games, I

just can't, I can't keep up, man.

911

I tried that Fortnite.

912

That was impossible.

913

You have to build.

914

I can't build.

915

You know, I can, I'm a doom

Wolfenstein kind of a guy.

916

I

917

Mike Gruen: don't build in my first person

shooter, so I wish I was better at that.

918

Um, I'm going to jump

ahead because it's tied in.

919

What's the worst video game

you've, uh, you've played worst?

920

Oh, man,

921

Nick Rundaug: uh, the, uh, Superman for

Nintendo 64, anyone that knows, knows it.

922

It's one of the worst ones.

923

I still, to this day, though,

I'm not a big Battletoads fan.

924

I think it's, it's impossible.

925

Um, so I'll also go with Battletoads.

926

All right.

927

Controversial.

928

Mike Gruen: Last one.

929

Uh, what's a charity or corporate

philanthropy that's near and dear to you?

930

Nick Rundaug: Yeah.

931

Uh, I'm a, I'm a veteran.

932

Um, I've worked, um, with wounded

warrior, uh, a few different times,

933

uh, really liked them and, uh,

had a friend that, that worked

934

directly for them, uh, as well.

935

So I always give a shout out to WDP.

936

Awesome.

937

Good job.

938

All right.

939

Tim Winkler: All right.

940

Great answers.

941

Minus the Battletoads answers.

942

I agree though.

943

It is near impossible.

944

Isn't it?

945

Like, have you ever, did

you ever beat Battletoads?

946

No, no,

947

Nick Rundaug: maybe, maybe

with a game genie, but no.

948

Tim Winkler: Awesome.

949

Uh, all right, Sarah, are you ready?

950

Sure.

951

All right, let's do it.

952

Can you describe the

culture at LaunchDarkly?

953

The

954

Sara Mazer: culture is developer first.

955

And so that includes just supporting

our own developers, but then we eat our

956

own dog food and we produce a product

that really does support developers over

957

anybody else, which is pretty cool to see.

958

So we do things that compete with

other companies out there, um,

959

say with experimentation that are

geared towards more marketing.

960

Roles, but we're always developer first

and that's just core to our philosophy.

961

And we try to make our own lives better.

962

And then by doing that, we make

our customers lives better.

963

Tim Winkler: So what kind of

technologist thrives at LaunchDarkly?

964

Sara Mazer: I think people

that really care about the user

965

experience for our product.

966

So it's not just writing cool features,

but actually seeing the excitement from

967

our customers and getting that feedback

and going back again, if we make a mistake

968

and making sure that we get it right.

969

And so the whole feedback loop and

hearing and celebrating success.

970

So we've got a lot of internal feeds where

we have somebody, you know, It has a good

971

comment out there on Twitter about lunch

darkly or on our own support channel.

972

We celebrate that internally.

973

Tim Winkler: What kind of tech roles

are you all usually hiring for?

974

Sara Mazer: So there's many different

tech roles from on the presale

975

side, solutions engineering to

professional services to engineering.

976

Um, I know we've had a couple of roles

open for reliability engineers in past.

977

Just, um, making sure that our customers

have the best experience at all times.

978

And platform engineers.

979

So typical SAS organization type growth.

980

Tim Winkler: What's an area of

GovTech modernization that you're most

981

excited to see in the next five years?

982

Sara Mazer: I'm excited to see where

AI takes government and technology.

983

So we're already seeing some people

pilot AI within the government agencies.

984

We're building features in our product

to help people use ai, um, and kind

985

of feature test or switch between

different types of AI models or prompts.

986

And I think that's really taking off

and it's gonna help the government

987

agencies in so many ways, just write

code faster, do things with less people.

988

Um, and it's gonna be an

exciting, you know, five years.

989

Tim Winkler: Can you describe

your morning routine?

990

Sara Mazer: Oh, um, morning routine.

991

I get woken up by my dogs and have to

take them out and go for a walk, usually

992

a mile around the block because it

takes forever for my one dog to decide

993

to go to the bathroom and then, uh,

get back in and eat breakfast and then

994

get online and get ready for the day.

995

Um, and then I do a series of meetings

with, um, Talking to customers about

996

potentially using LaunchDarkly or solving

heart problems or talking about FedRAMP,

997

trying to decide where we're going.

998

Going from here, um, talking about

veteran pie as an example and

999

working with DoD organizations

and how are we going to do that?

00:54:51,185 --> 00:54:56,464

So, um, it takes me through the

evening and then I chill out watching

00:54:56,515 --> 00:54:58,075

some YouTube before I go to bed.

00:54:58,665 --> 00:54:58,925

Tim Winkler: Nice.

00:54:59,894 --> 00:55:03,324

How do you handle, uh, your dogs when

they get into a street fight with Nick?

00:55:07,704 --> 00:55:09,284

Um, uh, moving on.

00:55:09,284 --> 00:55:10,844

What is your favorite app on your phone?

00:55:13,430 --> 00:55:16,289

Sara Mazer: It's got to

be YouTube or Tik TOK.

00:55:16,290 --> 00:55:21,520

I admit that, like, you know, if I'm,

if I have some downtime, even five

00:55:21,520 --> 00:55:26,170

minutes, I'm like scrolling through Tik

TOK, seeing what's, what's happening.

00:55:26,480 --> 00:55:32,189

I, I heard Mike's question about the,

the thing that you'd love to do, but

00:55:32,189 --> 00:55:38,110

you really are horrible at, for me, it's

like Tik TOK dances, like a breakdance

00:55:38,180 --> 00:55:39,740

through way back in the eighties.

00:55:40,175 --> 00:55:46,814

And like, I, my, my brain thinks

that I can do that, but yeah,

00:55:47,295 --> 00:55:49,185

Tim Winkler: some of those

dances are super impressive.

00:55:50,275 --> 00:55:54,455

Um, what's a charity or a corporate

philanthropy that's near and dear to you?

00:55:55,775 --> 00:55:58,715

Sara Mazer: Yeah, there's one

is speaking of dogs and pets.

00:55:58,794 --> 00:56:00,875

There's one in Gaithersburg, Maryland.

00:56:01,015 --> 00:56:02,474

It's called house with a heart.

00:56:03,025 --> 00:56:09,375

And it's for senior dogs, and so it's a

woman who has like tons and tons of little

00:56:09,385 --> 00:56:15,474

dogs and in her home and people come and

volunteer, send her donations, and they're

00:56:15,474 --> 00:56:21,575

all very senior dogs, last stages of their

lives, but it's just heartwarming to see

00:56:21,665 --> 00:56:25,835

that there are people like that out here

on the planet that have such a heart to

00:56:25,835 --> 00:56:27,735

take care of dogs and need like that.

00:56:28,895 --> 00:56:29,325

Tim Winkler: Very cool.

00:56:30,255 --> 00:56:32,735

If you could have dinner

with any celebrity past or

00:56:32,745 --> 00:56:34,275

present, who would it be with?

00:56:38,625 --> 00:56:41,575

Sara Mazer: Uh, I think

probably Oprah comes to mind.

00:56:42,635 --> 00:56:47,605

I just think she might be fun to

hang out with and certainly has met

00:56:47,654 --> 00:56:51,225

so many interesting people and I

could chill out on her fancy yacht.

00:56:55,465 --> 00:56:56,065

Tim Winkler: Good answer.

00:56:56,875 --> 00:56:59,925

What is the worst fashion trend

that you've ever followed?

00:57:03,660 --> 00:57:05,110

Sara Mazer: Oh man, there's been so many.

00:57:05,150 --> 00:57:10,140

I think I used to, I used to be a

big Madonna lover back in the 80s.

00:57:10,200 --> 00:57:14,580

Now you guys know how old I am, but

I used to dress like Madonna with the

00:57:15,500 --> 00:57:19,749

gloves, the lace gloves and all the

beads around my neck and everything.

00:57:20,170 --> 00:57:22,110

I don't think there's that

many pictures of me like that.

00:57:22,120 --> 00:57:22,710

Thank goodness.

00:57:22,940 --> 00:57:23,370

But yeah,

00:57:24,510 --> 00:57:25,460

Mike Gruen: pre pre tick tock.

00:57:25,460 --> 00:57:26,660

It's it works out.

00:57:27,820 --> 00:57:28,060

Yeah.

00:57:30,100 --> 00:57:30,690

Tim Winkler: Uh, all right.

00:57:30,690 --> 00:57:31,180

Last one.

00:57:31,180 --> 00:57:34,550

What is one thing that is

still on your bucket list?

00:57:37,630 --> 00:57:42,720

Sara Mazer: Oh, I want, um, I want

to go to Svalbard, which is one of

00:57:42,720 --> 00:57:49,250

the islands, um, north of Norway

that just seems so cool to me.

00:57:49,250 --> 00:57:54,940

It's like they have, um, polar

winter and like, During the winter,

00:57:54,940 --> 00:57:58,910

there's no sun for months, and then

in the summertime, it's just constant

00:57:58,930 --> 00:58:03,170

sun and beautiful landscapes, and

so I want to go there someday.

00:58:03,170 --> 00:58:03,960

It's on my bucket list.

00:58:07,360 --> 00:58:07,740

Yeah.

00:58:07,900 --> 00:58:10,150

S P A L B A R D.

00:58:10,660 --> 00:58:11,340

Tim Winkler: Oh, very cool.

00:58:11,680 --> 00:58:11,840

Yeah.

00:58:11,840 --> 00:58:15,419

I have a friend that went to Norway and

some of the pictures were just incredible.

00:58:16,040 --> 00:58:17,479

Um, cool.

00:58:17,529 --> 00:58:17,889

All right.

00:58:17,890 --> 00:58:20,079

That is a wrap.

00:58:20,140 --> 00:58:21,109

That wasn't too difficult.

00:58:21,109 --> 00:58:21,430

Was it?

00:58:22,379 --> 00:58:23,669

But quick, quick and easy.

00:58:24,450 --> 00:58:26,510

Thank you both so much for joining us.

00:58:26,550 --> 00:58:29,840

Uh, you both been really fantastic

guests and sharing your knowledge

00:58:29,840 --> 00:58:31,460

and the, uh, the FedRAMP space.

00:58:31,490 --> 00:58:34,150

I'm sure it's going to be very

helpful for, for any of those software

00:58:34,160 --> 00:58:36,350

companies out there looking to

work with the, with the government.

00:58:36,390 --> 00:58:38,900

So thank you both for

joining us on the pod.