Starting Here: Your Mission, Timeline, and Stakes

• In one sentence, describe the mission or program that requires this classified or multi‑classification connectivity.
• What is your target timeline for delivered connectivity and any fixed accreditation deadlines? Options: Immediate (0–3 months), Near-term (3–6 months), Quarter (6–12 months), Beyond 12 months, Date-driven (specific deadline — please specify)
• Who are the primary decision-makers, approvers, and technical leads for this effort? (select all that apply) Options: Agency CIO/Director of Enterprise Services, J6/G6 Communications Officer, Network Branch Chief / NOC Lead, Program Manager / PMO, Authorizing Official (AO), Acquisition / Contracting Officer, Facility Security Officer / ISSM, COMSEC Custodian, Other (please name), Prefer not to list
• If there are named stakeholders or points of contact we should include, list their role, name, and best contact method.
• Which single outcome would make you declare this engagement a clear success? Options: ATO within first RMF assessment cycle, Zero mission downtime during transition/cutover, Accredited cross-domain transfers, Full Type 1 crypto installed and operational, Sustainable long-term sustainment plan in place, Other (please specify)
• How urgent is avoiding mission disruption during modernization? Options: Critical — no disruption acceptable, High — only planned brief windows, Moderate — short planned windows okay, Low — flexible

What risks are you quietly telling yourself are 'good enough'?

• When you audit past modernization projects, what trade-offs did you accept that you now worry about?
• How often have prior modernization efforts required accreditation rework or additional RMF cycles? Options: Never, Once, Multiple times, Ongoing / frequent
• Describe the most recent accreditation or RMF failure: what was the finding, and what caused it?
• How frequently do vendor devices or new integrations introduce interoperability exceptions during testing? Options: Frequently, Sometimes, Rarely, Never, Unknown
• When accreditation or interoperability problems surface, what internal pressures (timeline, budget, career risk) most influence the decisions you make?

Where in your network would a failure be catastrophic?

• Which classification enclaves and boundaries are in scope for this project? (select all that apply) Options: Unclassified, SBU / Sensitive, Secret, TS/SCI, TS/SCI with SAP access, Other (please list)
• Do you have current topology and enclave boundary documentation available? Options: Complete and up-to-date, Partial—some maps and diagrams, Outdated documentation, No formal documentation
• If your documentation is partial or outdated, what are the most critical gaps we should know about (e.g., missing cross-domain flows, unknown chokepoints)?
• Which failure modes worry you most if a change is made (select all that apply)? Options: COMSEC compromise or mishandling, Encryption device mis-provisioning, Cross-domain data leakage, Single point of infrastructure failure, Configuration drift causing outages, Insufficient RMF evidence / documentation, Other (please specify)
• Share a recent incident or near-miss that revealed one of these failure modes and what the immediate impact was.

Imagine the day you receive the ATO — what will be different?

• What measurable success signals must be present to convince the Authorizing Official to sign off? (select all that apply) Options: Complete RMF evidence package, End‑to‑end encryption validated in production, Interoperability test matrix passed with legacy systems, Penetration tests remediated to AO satisfaction, Zero mission downtime observed during cutover, User acceptance and operational handover complete
• Which Zero Trust controls are non‑negotiable for your environment (e.g., identity assurance, microsegmentation, flow logging)?
• What is your ATO or accreditation deadline and are there intermediate gating milestones we must observe? Options: Fixed calendar date (please specify), Aligned to procurement milestones, Rolling / no fixed date, Unknown
• What KPIs will your leadership use to judge success (select all that apply)? Options: Time to ATO, Mission downtime hours, Packet loss / latency SLAs, Number of RMF findings, Engineers cleared & certified on site, On‑time procurement & staging
• List any acceptance criteria or test cases the Authorizing Official has already specified.

What's quietly blocking progress that vendors keep promising to fix?

• Which operational blockers are most likely to derail the schedule if not resolved? (select all that apply) Options: Insufficient NSA‑certified engineers, COMSEC handling and cleared facilities, Procurement lead times for crypto hardware, Lack of equipment staging and inventory control, Contractual ambiguity on responsibilities, Interoperability with legacy/third‑party systems, Other (please specify)
• What are your typical procurement lead times for critical encryption hardware, and have you experienced recent supplier delays (weeks)?
• How many cleared/NSA‑certified engineers are available internally right now? Options: None, 1–2, 3–5, 6–10, More than 10, Unknown / contractor‑mixed
• How many NSA‑certified engineers would the schedule realistically require from a partner during peak install windows?
• If staffing or procurement slips occur, describe the operational, political, or personal impacts you fear most.

If we partnered, how should we prove we deserve the keys to your environment?

• Which proof points matter most when evaluating a secure network integrator? (select all that apply) Options: Roster of NSA‑certified engineers with clearances, Documented ATO success rate and RMF histories, COMSEC custody and chain‑of‑custody procedures, Product‑specific integration experience (list vendors), References from comparable agency programs, DISA STIG and STIG remediation evidence, Other (please specify)
• What format of demonstration or evidence would most influence your acquisition decision? Options: Technical architecture assessment report, Lab demo / staged Type 1 provisioning, On‑site pilot installation, Whitepapers and compliance artifacts, Customer reference calls and site visits
• Are there named encryption devices, cross‑domain products, or versions we must demonstrate experience with? Please list them.
• Would you prefer iterative milestones with go/no‑go decision points during delivery, or a single approval gate at ATO? Options: Iterative milestones with go/no‑go, Single gate at ATO, Hybrid approach
• Who should be included in technical walkthroughs, demos, and vendor briefings on your side?

Three months from now — what will convince you we were the right choice?

• Which 90‑day milestone package would most increase your confidence? (select up to three) Options: Verified facility clearance & COMSEC handling plan, Completed and validated topology & enclave documentation, Staged equipment with chain‑of‑custody records, Type 1 crypto provisioning completed in lab, Interoperability test report with legacy systems, Draft RMF evidence package delivered
• How flexible are your installation and access windows for field engineering teams? Options: Fixed windows only — no exceptions, Somewhat flexible with notice, Very flexible, Unknown / depends on facility
• What would be an acceptable remediation SLA if an accreditation finding arises after deployment (timeframe and scope)?
• What communication cadence during deployment will put you at ease (select one)? Options: Daily standups with technical team, Twice‑weekly tactical updates, Weekly executive summary, Ad‑hoc on critical issues only
• Who will be the single technical point of contact for field engineers, and what is your preferred escalation path for critical issues?

Quick Snapshot: Where are we starting from?

• Give a one-line summary of your current classified/sensitive network footprint (sites, number of enclaves, primary classification levels).
• Which classification levels and enclave types are in scope today? Options: Unclassified, SBU (Sensitive But Unclassified), Confidential, Secret, Top Secret, TS/SCI
• How many physical sites and logical enclaves are we looking at for this effort? Options: 1, 2–5, 6–20, 21–50, 51+
• Roughly how many end systems, servers, and network devices (combined) fall inside the scoped enclaves? Options: <100, 100–499, 500–1,999, 2,000–9,999, 10,000+
• Who is the single decision owner for network accreditation and mission continuity (title/role)?

What single outage would stop everything right now?

• If one specific failure could immediately halt mission operations, what is it? Options: Loss of Type 1 crypto provisioning, Cross-domain transfer failure, Accreditation/AO denial, WAN backbone outage, Single-point hardware failure, Other
• How many times in the last 24 months has that kind of failure occurred (or nearly occurred)? Options: Never, Once, 2–3 times, 4–9 times, 10+
• When that failure happened or nearly happened, what mitigations were attempted and how effective were they?
• How quickly must you restore service before mission impact becomes unacceptable (RTO)? Options: Minutes, Under 1 hour, 1–8 hours, 8–24 hours, More than 24 hours
• How does the possibility of that outage affect your team’s willingness to approve changes or upgrades? Options: Very cautious, Cautious but open, Neutral, Eager to change

When 'segmented' might actually be porous

• Are you confident that enclave boundaries are fully documented and enforced — or could hidden flows cross boundaries today? Options: Confident — fully documented/enforced, Some uncertainty — partial documentation, Not confident — undocumented or porous
• List the primary data flows (source -> destination) that must never cross classifications or that require cross-domain guard controls.
• Which technologies currently enforce boundary controls (select all that apply)? Options: VLANs/VRFs, Firewalls (NGFW), Cross-domain solution (CDS), Diodes/Guards, Encryption devices (Type 1/Commercial), ACLs/NAC, Other
• How often do you reconcile logical diagrams with actual routing/firewall rules to catch 'drift'? Options: Weekly, Monthly, Quarterly, Annually, Never
• If we asked to review a current network diagram and an actual flow capture, would they match or reveal surprises? Options: Match closely, Some minor differences, Major discrepancies likely, We don't have both artifacts

Where accreditation is quietly fragile

• If your ATO deadline were moved up by 90 days, which accreditation element would you expect to struggle to meet? Options: System Security Plan (SSP), POA&M closure, RMF step evidence, Interoperability test records, COMSEC/keying evidence, Other
• Which RMF step is your program currently in? Options: Categorization, Select security controls, Implement controls, Assess controls, Authorize, Monitor
• How many open POA&Ms exist that directly affect connectivity or COMSEC, and how long have the oldest been open? Options: 0, 1–5 (oldest <3 months), 1–5 (oldest 3–12 months), 6–20 (oldest >12 months), 20+ / chronic
• Who is your Authorizing Official (AO) or Designated Accrediting Authority, and what are their top concerns about this environment?
• What evidence packages (e.g., test logs, DISA STIG checklists, COMSEC inventories) are available immediately versus those that will need creation? Options: Most evidence ready, Partial evidence ready, Most evidence needs creation, Unsure

Secrets, Keys, and the Clock on Crypto

• Do you have a complete, audited inventory of all cryptographic devices and keying material that must be reprovisioned or migrated? Options: Yes — audited and current, Partially — some gaps, No — inventory incomplete, Unsure
• How many devices require Type 1 provisioning or Type 1-equivalent handling as part of this project? Options: None, 1–10, 11–50, 51–200, 200+
• Who holds COMSEC custody today and what is their capacity to support inventories, turnover, and escorted installs?
• What is the longest lead-time item in the crypto provisioning chain (e.g., device procurement, NSA keying, courier windows, certified engineer availability)? Options: Device procurement, NSA key distribution, NSA-certified staff scheduling, Facility/escort approvals, Transport/logistics, Other
• On a scale from 1–5, how confident are you that crypto provisioning timelines will align with your deployment windows? Options: 1 — Not confident, 2, 3 — Somewhat confident, 4, 5 — Very confident
• If there is a shortfall in NSA-certified engineers, what fallback do you have (e.g., contractors, phased installs, remote provisioning)?

When 'it's compatible' turns out to be wishful thinking

• Have you ever assumed two vendors/protocols would interoperate and then discovered they didn't in the field? Options: Yes — caused delays, Yes — worked-around quickly, No — always tested beforehand, Unsure
• List the major vendors, models, and firmware versions of devices involved in cross-enclave connectivity (firewalls, routers, encryption devices, CDS).
• Which interoperability tests have been run in a lab environment and which remain untested? Options: End-to-end encryption provisioning, Cross-domain transfer validation, Protocol translation tests, Performance under load, None tested
• When interoperability exceptions were found previously, how long did remediation take and who owned the fix?
• Would you allow a staged lab rehearsal with our engineers before field installation (requires sanitized test data and access)? Options: Yes — schedule immediately, Yes — after approvals, No — not possible, Unsure

Have we actually practiced the worst-case?

• When was the last time you executed a full cutover rehearsal (including rollback and accreditation evidence capture)? Options: Within 3 months, 3–12 months, 1–2 years, Never
• Which failure scenarios have you not practiced but worry about (select all that apply)? Options: COMSEC compromise, Cross-domain data leakage, Partial device compatibility failure, Key provisioning delay, Backout/rollback failure, AO rejection of evidence
• Do you have a documented rollback plan with clear decision gates and owner signatures? Options: Yes, documented and rehearsed, Documented but not rehearsed, No documented rollback plan, Unsure
• How comfortable would your operations team be executing a rollback under AO direction, emotionally and technically? Options: Very comfortable, Somewhat comfortable, Reluctant, Would require external support
• What monitoring and alerting would tell you in time to avoid a mission-ending failure?

If constraints vanished for a moment

• If budget, staff, and lead times were not constraints, what would an ideal migration look like for your program?
• What are the non-negotiable success criteria the AO and CIO must see to sign off on an ATO? Options: Full STIG compliance, Complete COMSEC inventory & keying evidence, Interoperability test logs, Performance benchmarks met, POA&Ms closed/acceptable
• Which measurable signals would make you say, 'This migration succeeded' (e.g., latency, throughput, no POA&Ms, AO endorsement)?
• What level of transparency and update cadence do decision-makers expect during cutover (daily, twice-daily, on-demand)? Options: Daily, Twice daily, Weekly, On-demand/real-time
• Emotionally, what would relief look like to your team after acceptance (confidence, reduced overtime, fewer meeting escalations, other)? Options: Renewed confidence, Lower operational stress, Fewer emergency tasks, Other

Concrete next steps we can take together

• Which artifacts can you share immediately to accelerate mapping (network diagrams, STIG reports, COMSEC inventories, RMF artifacts)? Options: Network diagrams, STIG/SCAP reports, COMSEC inventory, RMF evidence packages, None ready
• Are you able to grant our engineering team a controlled lab or sanitized data environment for pre-deployment testing? Options: Yes — immediate access, Yes — with approvals, No — cannot provide, Unsure
• What is the single highest-priority gap you'd like us to assess first?
• How soon can we schedule a 90–120 minute technical deep-dive with your network, COMSEC, and RMF leads? Options: This week, Within 2 weeks, Within a month, Longer
• Who else should be included in discovery to remove blockers (list names/roles: AO, COMSEC custodian, network ops, procurement, facilities)?

Quick Read: Where We Stand Right Now

• In one sentence, how would you describe your program’s current readiness for a classified deployment?
• What is your target window for fieldwork to begin? Options: Within 30 days, 31–60 days, 61–90 days, 3–6 months, 6+ months, No firm date
• Which of these is the primary driver for this deployment right now? Options: ATO/Accreditation deadline, Facility standup, Bandwidth/modernization need, Zero Trust mandate, Interoperability need, Other
• Who is the single point of contact we should coordinate pre-deployment logistics with (name, role, phone/email)?
• If you had to rank confidence in starting fieldwork as of today, where would you put it? Options: Very confident, Somewhat confident, Neutral, Concerned, Not ready

What Keeps You Awake at Night About the Field Work?

• If one thing goes wrong on day one of fieldwork and it causes a mission delay, what would that one thing most likely be?
• How often have past deployments on similar programs encountered schedule slips due to access or clearance issues? Options: Almost always, Often, Sometimes, Rarely, Never
• Tell us about a previous deployment hiccup that still influences how you plan today—what happened and what was the downstream impact?
• Which outcome worries you more emotionally: mission downtime during cutover, failing accreditation tests, or not having enough certified staff on-site? Explain. Options: Mission downtime, Failed accreditation, Insufficient certified staff, Other
• How long can the mission tolerate a deployment-related outage before leadership escalates? Options: Minutes, Hours, A day, Multiple days, Cannot tolerate any outage

Who Has the Keys—and Will They Be There?

• Do the facilities where work will occur already have the required personnel clearances and facility accreditation levels? Options: All required clearances present, Some personnel lack clearances, Facility accreditation pending, Facility lacks required accreditation, Unsure
• Who controls physical and logical access during installation (e.g., facility security officer, base operations, contractor escort)? List roles and names where possible.
• Are there scheduled access windows or blackout periods we must plan around (e.g., exercises, holidays, blackout dates)? Options: Yes—specific dates known, Yes—recurring windows, No, Unsure
• What escorting or badging requirements will our engineers need to meet before entry (e.g., escorted access only, inbound visitor badges, COMSEC room clearance)? Options: Unescorted access allowed, Escorted access required, Special badges required, COMSEC room clearance required, Other
• Describe any previous delays caused by access or escort logistics and what solved them.

COMSEC and Cryptographic Material: Are We Really Ready?

• If our COMSEC chain is even one link short on day zero, how quickly can you escalate and resolve it—hours, days, or weeks? Options: Within hours, 1–2 days, 3–7 days, Weeks, No process in place
• List who is currently authorized as COMSEC custodians and whether custody transfer procedures are documented and practiced.
• Which categories of cryptographic material will we need to stage (Type 1 keys, key encryption keys, device fills, or tokens)? Options: Type 1 keys, Key encryption keys, Device fills, Tokens/Smartcards, Other
• Have you previously experienced delays due to COMSEC handling or courier limitations? If so, how was it mitigated?
• How comfortable are your custodians with rapid in-field keying events and the associated recordkeeping? Options: Very comfortable, Somewhat comfortable, Limited experience, Not comfortable

Staging, Inventory, and Logistics: Can Your Chain Handle It?

• If staging is delayed by 2–4 weeks due to supply or shipping issues, which components would cause the biggest program impact? Options: Encryption devices, Cross-domain modules, Cabling/racks, Power/environment equipment, Sustainment spares, Other
• Do you currently have an updated bill of materials (BOM) with serials, firmware versions, and vendor part numbers for every device to be staged? Options: Yes, complete and current, Partially complete, No, Unsure
• Where will staging occur (on-site secure facility, vendor staging yard, other government facility), and what physical security controls are in place there? Options: On-site secure facility, Vendor secure staging, Other government facility, Offsite commercial staging
• Tell us about your inventory reconciliation cadence—how often do you verify serials, bin counts, and firmware baselines before shipping to the field? Options: Daily, Weekly, Before each shipment, Ad hoc, None
• What are the top three logistics failure modes you want us to plan contingencies for?

Test Grounds and Fail-Safes: Where Will We Break Things First?

• Why would running without a field test environment be risky for this deployment?
• What type of test environment can you provide before fieldwork—lab with representative enclave, emulated network, or on-site sandbox? Options: Full lab with representative enclave, Emulated/test harness, On-site sandbox, Limited bench testing, None available
• Which interoperability tests are mandatory to pass prior to installing in the production enclave? Options: Encryption interoperability, Cross-domain transfer tests, Routing and peering, COMSEC provisioning, Performance/load testing, Other
• How do you prefer we handle test failures that require a design change—immediate stop to redesign or continue with mitigations and patch later? Options: Stop and redesign, Continue with mitigations and patch later, Case-by-case with AO input, Other
• Describe the last time a test uncovered an interoperability exception and how that was resolved operationally and politically.

People and Teams: Do We Have the Right Hands-on-Deck?

• If we needed to put NSA-certified engineers on site tomorrow, how many are cleared and available from your side for the initial 30 days? Options: All required available, Partially available, None available, Unknown—we need to check
• List the roles you expect to have on-site during fieldwork (e.g., NSA-certified crypto engineers, network engineers, facility security, AO representative) and who fills them today.
• How disruptive would it be to pull mission staff into installation activities if contractor staffing falls short (minor, moderate, major impact)? Options: Minor, Moderate, Major, Not possible
• What training or ramp-up do your in-house engineers typically need before they can safely support Type 1 installations? Options: None—already trained, Short refresher (days), Multi-week training, Formal certification required, Unsure
• Are there union, labor, or site-specific constraints that affect contractor hours, overtime, or after-hours work? Options: Yes—significant constraints, Yes—minor constraints, No constraints, Unsure

If the Plan Slips: What’s Our Real Backup?

• When timelines slip, what contingency has historically preserved mission continuity (e.g., temporary bridging, phased cutover, fall-back circuits)? Options: Temporary bridging, Phased cutover, Fallback circuits, Manual procedures, No contingency
• How quickly can your program activate a fall-back plan if an accreditation test fails at final validation? Options: Same day, 1–3 days, 1 week, Multiple weeks, No fall-back
• What operational compromises are acceptable during remediation (reduced bandwidth, scheduled windows only, degraded cross-domain capability)? Options: Reduced bandwidth, Scheduled windows, Degraded functionality allowed, No compromises allowed, Other
• Who must sign off to trigger the contingency plan and how reachable are they during field operations? Options: Program director, Authorizing Official, Facility commander, Operations lead, Other
• Describe a contingency activation you ran before—what worked, what failed, and what you would change next time?

Signoffs, Evidence, and the Path to Green

• What is the minimal set of RMF evidence and accreditation artifacts your AO will require at final validation to accept the deployment? Options: POA&M closed items, Test reports, COMSEC logs, Configuration baselines, Other
• Who is the Authorizing Official (AO) or AO’s representative we should engage early, and how do they prefer evidence presented?
• Have you ever had an AO reject acceptance because evidence format or traceability was insufficient? What was missing? Options: Yes—format issues, Yes—traceability issues, Yes—content gaps, No
• Would you prefer our team pre-package accreditation folders for review (recommended), or to provide raw artifacts for your integration? Options: Pre-packaged folders, Raw artifacts, Hybrid—pre-package major items, Unsure
• What would success look like to your leadership at handover, in one short sentence?

Quick Intro — What Brought You Here Today?

• What's the primary trigger prompting you to explore secure network modernization right now? Options: Aging infrastructure, Zero Trust mandate / CIO deadline, New facility standup, Performance for intelligence/video workloads, Recent security incident, Other
• Which program or mission does this modernization support (name or short description)?
• What is your decision timeframe to have a deployed, accredited capability? Options: <= 3 months, 3–6 months, 6–9 months, 9–12 months, More than 12 months, Undetermined
• Who would you like to have in the room for an initial technical intake (roles, names or offices)?
• On a scale from 1–5, how urgent does this program feel to your leadership (1 = advisory, 5 = mission-critical with deadline)? Options: 1, 2, 3, 4, 5

Are You Comfortable Betting the Mission on 'Good Enough'?

• If a modernization hiccup interrupted classified communications for 24–72 hours, what would happen to mission operations? Options: Operations stop entirely, Severe degradation, mission at risk, Manageable degradation with workarounds, Minor impact, Don't know
• Can you describe a recent outage, failure mode, or near-miss that affected secure connectivity and what the immediate impact was?
• Which workloads or systems are most sensitive to connectivity loss (select all that apply)? Options: Intelligence data feeds, Video teleconferencing, Cross-domain transfers, Command and control, Logistics/ERP, Other
• How long could the mission continue without classified connectivity before unacceptable risk occurs? Options: < 4 hours, 4–24 hours, 24–72 hours, > 72 hours, Unknown
• How worried are you—emotionally—about the risk of disruption during modernization efforts? Options: Not worried, Somewhat concerned, Very concerned, Extremely anxious

Show Me Your Map — Where Does the Network Hurt?

• Where in your current topology are data flows most likely to break mission continuity right now? Options: Edge/transport layer, Enclave boundaries / cross-domain, Encryption device provisioning, Core routing / datacenter, Satellite / tactical links, Other
• Do you have up-to-date network diagrams and enclave boundary definitions that reflect current state? Options: Fully up-to-date, Partially updated, Outdated, No diagrams available
• List the classification enclaves involved and any known accreditation gaps for each (e.g., CUI, Secret, Top Secret, Cross Domain).
• Who currently manages COMSEC custody and Type 1 provisioning for these enclaves? Options: Internal COMSEC custodian, Contractor with authorization, No formal custodian, Don't know
• How frequently have interoperability tests between encryption devices or CDS components failed in the last 12 months? Options: Never, Rarely (1–2 times), Occasionally (3–5 times), Frequently (6+ times), Not tracked

What’s at Stake — How Bad Would It Be if This Fails?

• If accreditation stalls and your ATO timeline slips, what are the programmatic consequences? Options: Mission delay, Funding reprogramming, Operational risk to forces, Contractual penalties, Other
• Have prior accreditation reviews required remediation that extended schedules? Tell us about the worst example.
• Who is the Authorizing Official (AO) or equivalent decision authority, and what outcomes will satisfy them?
• What specific accreditation evidence has been most difficult to produce or defend in past RMF cycles? Options: System Security Plan (SSP), Interoperability test logs, COMSEC handling plans, Continuous monitoring evidence, Other
• How does the possibility of mission disruption make you feel when you brief leadership?

If Accreditation Couldn’t Be Your Bottleneck, What Would You Deliver?

• Imagine accreditation is guaranteed—what measurable connectivity outcomes would you expect at handoff? Options: ATO in first RMF cycle, Zero unresolved interop exceptions, Full Type 1 crypto installed, End-to-end latency/SLA targets met, Other
• What are the target bandwidth, latency, and availability SLAs required for the mission?
• Which Zero Trust capabilities are non-negotiable for your program (select all that apply)? Options: Microsegmentation, Device authentication, Least-privilege access, Continuous monitoring, Data-centric encryption, Other
• What objective success signals will you present to your AO to demonstrate mission readiness?
• Is there a hard accreditation deadline set by leadership or external policy that cannot be moved? Options: Yes, a fixed date, Yes, a target window, No specific date, Undetermined

Who Are the Real Decision-Makers (and Hidden Gatekeepers)?

• Who in your organization can singlehandedly delay or accelerate accreditation, procurement, or access? Options: CIO/Director, Authorizing Official, Contracting Officer, ISSO/CISO, Facility Security Officer, Other
• For each stakeholder you selected, what does 'good' look like to them and how do their priorities differ?
• Are there external stakeholders (e.g., combatant commands, IL2/IL3 authorities) who must be aligned? If so, who?
• How do political, budgetary, or calendar constraints (e.g., end of fiscal year, deployment windows) affect your timeline?
• What is your preferred escalation path and cadence when decisions stall? Options: Weekly leadership sync, Direct AO engagement, Program office escalation, Contracting officer notification, Other

Where Have Attempts to Modernize Fallen Short?

• What previous modernization efforts delivered the worst surprises, and why did those surprises happen?
• Which vendors or approaches have you tried, and what specifically did you ask them to fix that wasn’t resolved?
• Which failure modes caused the longest remediation cycles (documentation gaps, device interop, COMSEC mishandling, staffing shortages, procurement delays)? Options: Documentation gaps, Device interop, COMSEC mishandling, Staffing shortages, Procurement delays, Other
• How long did remediation take in your worst-case example, and what blocked progress most of the time?
• What would have changed your confidence in that past effort—better staffing, clearer acceptance criteria, earlier COMSEC staging, or something else? Options: More certified engineers, Clearer acceptance criteria, Earlier COMSEC staging, Stronger program governance, Other

Who’s Going to Touch the Boxes — Are They Ready?

• Do you have assured access to cleared, NSA-certified engineers when the schedule is critical? Options: Yes, internal team, Yes, contractor partners, Limited availability, No assured access
• How many NSA-certified engineers (or equivalent) are available to support installation and Type 1 provisioning when needed? Options: 0, 1–2, 3–5, 6–10, 10+
• What is the current status of facility clearances and COMSEC handling authorizations at target sites? Options: Fully cleared for COMSEC, Partial clearance, pending actions, Not cleared, Unknown
• What access windows, staging constraints, or installation blackout periods should we plan around?
• If certified engineers become unavailable, what contingency options exist (alternate contractors, delayed install, phased approach)?

What Would a Smooth Deployment Feel Like in the First 30–90 Days?

• If deployment goes flawlessly, what will you observe on day 1, week 4, and day 90?
• Which acceptance tests and RMF evidence items must be completed for the AO to sign off? Options: Functional interoperability tests, COMSEC inventory and handling logs, SSP and POA&M review, RMF assessment report, Continuous monitoring baselines, Other
• How many interoperability exceptions are acceptable at handover, and how will they be prioritized for remediation? Options: None acceptable, 1–2 minor exceptions, Several acceptable with remediation plan, Undetermined
• What training or sustainment handover will your operations team need to take responsibility after deployment? Options: Formal training sessions, Handbook + runbooks, Shadow ops with vendor, Ongoing managed services, Other
• How would you prefer ongoing support and compliance responsibilities be divided between your team and a vendor?

What Keeps You Up at Night in the Final 72 Hours?

• What's the single biggest last-minute surprise that has derailed previous installs? Options: Missing COMSEC inventory, Failed interoperability test, Site access denied, Equipment delays, Staffing no-shows, Other
• What pre-deployment checks do you wish had been done earlier to avoid that surprise?
• Do you maintain a formal staging inventory and chain-of-custody process for COMSEC and cryptographic equipment? Options: Yes, mature process, Partial process, Ad-hoc, No
• Who is authorized to approve last-minute changes to installation sequencing or access permissions?
• If we identified a showstopper 48 hours before install, what is your preferred mitigation path? Options: Delay with contingency plan, Proceed with risk acceptance, Scale down scope, Escalate to AO immediately, Other

Agreeing Small Next Steps — How Do We Make This Real?

• If we don't lock a next step now, what is the realistic chance this program slips beyond your deadline? Options: High chance of slip, Moderate chance, Low chance, Uncertain
• What is the most useful immediate next step from your perspective: technical architecture assessment, COMSEC staging plan, procurement lead-time review, or a stakeholder alignment workshop? Options: Technical architecture assessment, COMSEC staging plan, Procurement lead-time review, Stakeholder alignment workshop, Other
• Who must approve any follow-up activity and who should receive an executive summary after the next engagement?
• What documents or artifacts can you share before the next meeting to accelerate discovery (network diagram, SSP, COMSEC manifest, procurement timelines)? Options: Network diagram, SSP, COMSEC manifest, Procurement timelines, None available yet
• When would you be available for a focused 90-minute technical intake with your technical leads and AO representation? Options: Within 1 week, 1–2 weeks, 2–4 weeks, More than 4 weeks, Undetermined