How do I show leadership how close we are to FedRAMP certification?

The clearest way is to report progress against the milestones FedRAMP itself sets out, using a gap analysis that is kept up to date. FedRAMP is the U.S. government's security program for cloud software, and a gap analysis is a review of how far a company's product is from meeting its requirements. Companies listed in FedRAMP's public directory of cloud products are already required to publish progress updates every quarter, so the same report can serve both leadership and FedRAMP.

Milestones to report against:

These stages come straight from FedRAMP's rules:

The progress FedRAMP requires:

Once a product is listed on the Marketplace, the company must show continuous progress against its own goals and milestones, updated at least every quarter on its trust center or website. A trust center is a secure website, run by the company, where approved federal agencies can view its security and certification information. The company must also schedule an assessment for Class B, C or D, the higher certification tiers, within two years of first being listed.

Keeping the picture current:

A one-time gap analysis, such as a static spreadsheet, goes out of date as the product and the work change. Leaders get a truer view from an analysis that is updated as gaps close, and the same view can then feed the quarterly progress update that FedRAMP requires.

Why leadership matters:

Leadership must commit to the "considerable effort" of adapting the business to FedRAMP's requirements, and support from the top is among the main factors that decide how long certification takes.