Executive summary
| Footprint | KTG / Cyber overhead (hrs) | Cash (monthly NTE) | Cash (vendor / one-time) | Decision |
|---|---|---|---|---|
| Innovation Lab | KTG 160 · Cyber 90 | $8K cloud + AI | None assumed | Decisions 1–5 |
| CUI pilot | KTG 240 · Cyber 268 · 1099 surge | $7K cloud + AI | 3PAO optional (vendor quote) | Decisions 6–7 |
| IL5 gold load | Future overhead program | $15K–$25K baseline cloud | 3PAO / assessment (vendor) | Deferred |
Decision 7 funds the CUI pilot only. TECOM and Navy are the first promoted workloads. DHS and similar buyers reuse the TECOM build without a new platform program. Full FedRAMP Moderate or TX-RAMP accreditation for commercial hosting sales is a follow-on phase inside the same footprint, not a day-one requirement for the pilot.
Labor model
Do not read this page as a labor rate card. Internal work is staffed in this order:
- Overhead first (KTG / Cyber hours below): Staff already in plan. Compliance owns SSP and intake on separate overhead, not counted in the KTG/Cyber columns.
- 1099 surge second: Decision 5 ($100/hr, NTE) covers prototyping, integration, and sales engineering when overhead capacity is saturated. During the 90-day CUI pilot sprint, Decision 7 raises that NTE to 120 hours per month.
- Vendors when contracted: 3PAO or accelerated assessment support is a vendor invoice, quoted separately, not overhead converted to cash.
| Work package | KTG (hrs) | Cyber (hrs) | Window | 1099 surge |
|---|---|---|---|---|
| Firm AWS org + lab migration (Decision 1) | 100 | 50 | Weeks 1–4 | If overlap |
| Entra + Sentinel seams (Decisions 2–3) | 60 | 40 | Weeks 2–6 | If overlap |
| Innovation Lab subtotal · Decisions 1–5 | ||||
| 160 | 90 | Decision 5 NTE | ||
| CUI pilot landing zone | 40 | 120 | Weeks 1–6 | — |
| Promote TECOM through gate | 100 | 48 | Weeks 4–10 | If queued |
| Promote Navy through gate | 80 | 40 | Weeks 6–12 | If queued |
| Pilot monitoring and operator access | 20 | 60 | Weeks 8–12 | — |
| CUI pilot subtotal · 90-day sprint (Decisions 6–7) | ||||
| 240 | 268 | Decision 7 raised NTE | ||
| Compliance: pilot SSP, intake, boundary package (separate overhead, not in table) | ||||
Planning NTE hours for capacity conversations, not a cash conversion. Per additional promoted demo after Navy: about KTG 60 and Cyber 32.
Footprint 1: Innovation Lab (synthetic)
Current kearneysandbox.com stack: main site plus Navy, TECOM, AD/CD, SOAR patterns, Cognito, GuardDuty, CloudTrail, optional SageMaker and Bedrock.
Migration to firm AWS org (Decision 1)
Labor only, no new cash line. KTG 100 hours, Cyber 50 hours for state migration, SCPs, billing ownership, and break-glass. Entra and Sentinel seams add KTG 60 and Cyber 40 (Decisions 2–3). Use Decision 5 1099 surge only if the sprint overlaps other commitments.
Monthly cloud run-rate ($8,000 NTE)
| Line | Monthly | Notes |
|---|---|---|
| CloudFront, API Gateway, Lambda, S3 | $1,200–$2,000 | Four distributions, demo APIs, storage |
| Security monitoring (GuardDuty, CloudTrail, Athena) | $250–$450 | Matches current sandbox monitoring design |
| SageMaker Studio (if enabled) | $150–$500 | Notebook instance hours |
| Bedrock and third-party AI tokens | $2,500–$4,000 | Demo and experiment load; trued up quarterly |
| Route 53, KMS, Cognito, misc. | $200–$400 | |
| Contingency / burst | $900–$1,650 | |
| Total synthetic lab | $8,000 | Decision 4 cap |
Footprint 2: Commercial CUI pilot (client-data demos)
Dedicated AWS commercial account. Hard isolation from Innovation Lab and from GCC High. Workloads arrive only via promotion gate (IaC rebuild, SBOM, client approval). Target: first client CUI demo in pilot within 90 days of funding.
90-day build (KTG / Cyber overhead + optional vendor)
| Work package | KTG (hrs) | Cyber (hrs) | Cash ask |
|---|---|---|---|
| Pilot landing zone (account, VPC, KMS, Sentinel logging, IAM) | 40 | 120 | In $7K/mo when live |
| Promote TECOM through gate (priority 1) | 100 | 48 | — |
| Promote Navy through gate (priority 2) | 80 | 40 | — |
| Pilot monitoring and operator access | 20 | 60 | — |
| Pilot SSP, intake, boundary package | Compliance overhead (not KTG/Cyber) | — | |
| Optional 3PAO readiness review | Vendor | Quoted separately | |
| CUI pilot subtotal | 240 | 268 | |
1099 surge during pilot: raise Decision 5 from 80 to 120 hours per month for 90 days (max $12,000 per month at $100/hr). That is the only new labor-cash line beyond overhead already in plan.
Monthly cloud run-rate ($7,000 NTE)
| Line | Monthly | Notes |
|---|---|---|
| AWS commercial (2 AZ, NAT, endpoints, 2 demo stacks) | $2,500–$3,500 | Smaller than full multi-tenant hosting |
| Bedrock / AI in CUI boundary | $1,500–$2,500 | Scoped to promoted demos |
| Log volume increment to Sentinel | $300–$800 | Often marginal on existing G5 |
| Storage, backup, keys | $400–$700 | Client data at rest encrypted |
| Contingency | $500–$1,500 | |
| Total pilot cloud + AI | $7,000 | Decision 7 · overhead labor not in this row |
Incident and liability posture (pilot): the CUI pilot holds real client data, so it carries an incident-response plan, defined breach-notification responsibilities per the client agreement, and confirmation of cyber-liability coverage scoped to hosted client data before first ingest. Hard account isolation limits blast radius to a single client enclave. Data-type screening and client approval gate every ingest. Confirm coverage limits and notification terms with counsel and the carrier as part of the Decision 6 charter.
Per additional promoted demo (after TECOM / Navy)
| Item | Staffing / cash |
|---|---|
| Gate: rebuild + SBOM + security review | KTG ~60 · Cyber ~32 overhead; 1099 if queued |
| Incremental monthly cloud per demo | $400–$900 |
AD/CD and SOAR promotion are phase 2 of the pilot unless CGO reprioritizes.
Footprint 3: IL5 gold load (future hosting)
Not in today's decision packet. Cash below is cloud and vendor only. Build and accreditation labor sit on a future overhead program charter, not invented rate cards.
| Item | Type | Planning range |
|---|---|---|
| Gold load engineering | Overhead program | Charter when sponsor path is set |
| SSP and assessment support | Overhead Compliance | Same program |
| 3PAO / assessment fees | Vendor cash | Quote per engagement |
| Azure Government subscription | Cash | $5K–$15K/mo when IL5 on Azure |
| Baseline cloud ops (pre-client) | Cash | $15K–$25K/mo GovCloud or Azure Gov |
| Per-client stamp-out delta assessment | Vendor + overhead | Vendor portion quoted per client |