Preparation (gap analysis, documentation): 1-3 months but can extend to 6 months, Security Assessment: 4-6 months usually but can extend to 9 months, Remediation: 1-2 months, Review: 2-3 months, FedRAMP Authorization process: 1-2 months.