The compliance tax: what it actually costs to ship software to the U.S. government

Engineering teams shipping software to the U.S. federal government face a compounding compliance burden from overlapping frameworks like FedRAMP, CMMC, STIG, ITAR, and EO 14028. Common failure modes include late compliance discovery, hand-assembled audit evidence, single artifact anomalies causing multi-month delays, lack of central enforcement, policy layer drift, and mandatory self-hosted/air-gapped deployment that eliminates most commercial DevOps tooling. Organizations routinely spend 40+ hours/month on manual compliance verification. The post outlines what an effective solution requires — continuous evidence collection at build time, centralized enforcement, gradual rollout, air-gap capability, and composable evidence across products — and introduces Earthly Lunar as a guardrails engine designed to address these needs.