The 2026 Federal Readiness Playbook for ISVs — Chapter 2: Readiness, Scored

From a feeling to a number

Chapter 1 ended on a question every serious effort should start from: where do we actually stand? Most ISVs answer it with a feeling — “we’re probably in decent shape,” or “we’re not ready yet” — and a feeling is impossible to act on. You cannot sequence work against a vibe, you cannot show a prime a vibe, and you cannot tell whether this quarter’s effort moved you closer to a FedRAMP 20x window or just felt busy.

The fix is to make readiness a measured position instead of a mood. When “ready” is a number with named parts, three things become possible at once: you can see which parts are strong and which are thin, you can put the thin parts in priority order, and you can watch the number move as you work. This chapter is about that number — what it is, what it’s made of, and how to read it honestly.

The Federal Readiness Score

GovExpress expresses readiness as a 100-point Federal Readiness Score: a single number that rolls many observable factors into one position you can read at a glance and track over time. It is GovExpress’s analytical opinion, produced by applying a published methodology to public federal data. It is not a credit score, not a consumer report, and not a rating of financial condition or creditworthiness.

Two properties matter more than the number itself:

• It starts from the public record. The score on any vendor you search is computed from public federal sources: SAM.gov registrations, USASpending and FPDS obligation records, the FedRAMP Marketplace, GSA CALC+ labor-rate data, and SBIR.gov awards. Your own full report adds what you tell us in the intake, the things public data cannot see, and those answers are shown as self-reported, never as a verified record.
• It is comparable. Because every company is scored the same way from the same kinds of data, one vendor’s position can be read against another’s. In a market with a thin reference set at the opening (Chapter 1), a comparable number is worth more than a paragraph of self-description.

The weights and thresholds behind the score are proprietary and not published here. What a seller needs is not the arithmetic. It is the shape of the picture the score draws.

The 12 categories

The score covers 12 categories, each answering a question a federal buyer weighs. The methodology page lists them all with a line on each; the ones that most often decide an ISV’s first federal year are:

1. Registration & Identity. Are you registered, current, and unambiguous in the government’s own systems? This is table stakes: a vendor buyers cannot find is not evaluated at all.
2. Compliance Posture. Publicly observable FedRAMP, CMMC, and SOC 2 signals and, the load-bearing distinction of this whole book, which of them are verified and which are self-reported. SOC 2 holders usually lead here.
3. Market Fit & TAM. How your offering maps to what agencies actually buy, or whether you would be pushing into a market that isn’t there.
4. Competitive Position. How you sit among the vendors already winning your market. A strong product in a crowded federal niche reads differently from the same product in an open one.
5. Financial Readiness. Public signals of your capacity to take on federal work.
6. Past Performance. Your public federal track record: engagements, agencies, recency. A first-time seller starts thin here by definition, and the score says so rather than papering over it.

The other six (Certifications & Set-Asides, Organizational Capability, Product Architecture, Contract Vehicle Strategy, Channel & Partnership Readiness, and Intelligence & Pipeline Signals) fill in the rest of the picture.

The point of named categories is diagnostic. A single number tells you whether you’re ready; the categories tell you why, which is the only thing you can act on. Two companies can share a score and need completely different work: one thin on registration and past performance, another strong there but weak on market fit.

The five tiers

The score reads as one of five tiers, so the number lands as a status you can say out loud. In ascending order:

• Not Federal Ready. No federal evidence on the public record yet. The first work is registration, and telling the diagnostic what public data cannot see.
• Pre-Federal. Early in the federal journey. Foundation work (registration, first certifications, a first target agency) is in flight. Most SOC 2-holding ISVs with no federal history start here or one tier below.
• Federal Emerging. An active presence in SAM.gov and USASpending, and a moderate fit between what you sell and what agencies buy. The gaps are specific and nameable, which is where a focused 90-day plan (Chapter 5) tends to move the needle fastest.
• Federal Active. Live federal traction: engagements on the record across more than one agency.
• Federal Established. A strong incumbent posture across the categories the score covers.

The numeric band behind each tier is not published yet; the methodology page will carry the ranges once they are confirmed. What a seller needs from the tier is the direction of travel: where you are and what “up” looks like.

Why a SOC 2 holder’s shape is lopsided (and why that’s useful)

Chapter 1 framed the opportunity for SOC 2-holding ISVs; the score explains why their readiness picture is almost always lopsided in a predictable way. A mature commercial security program banks real strength on compliance posture — that is exactly what a SOC 2 is — while a company scores thin on the federal-specific categories a commercial business never had reason to build: past performance, registration and visibility, and often market fit against federal demand.

That lopsidedness is not bad news; it is a map. It tells you the expensive part (a real, examined security program) is already done, and the remaining work is federal-specific and finite. Seeing which categories are strong and which are thin — before an evaluator does — is the entire reason to score readiness rather than feel it.

What the score does not do

Two honest limits, stated up front because credibility is the point:

• A score is a snapshot, not a verdict. It reflects observable federal data at a moment in time. It moves as you do the work — which is what makes the 90-day plan (Chapter 5) worth building.
• A high compliance number is not the same as verified compliance. This is important enough that it is the whole of the next chapter. A credential a company claims in its intake shows up labelled self-reported; whether it is independently verified is a separate question, and federal buyers are built to ask it.

Where this goes next

Chapter 3 takes the single most consequential category — compliance posture — and opens it up: verified versus self-attested, why federal buyers discount a claim they can’t check, and how a compliance overlay shows the difference, source and date attached. It is the most common ISV misread of the whole federal on-ramp, and getting it right is most of what separates a company that looks ready from one that is.

Before then, the takeaway from this chapter is small and concrete: stop asking whether you feel ready. Get the number, read the categories, and find out which two or three are holding you back. Everything after this is about moving them.