Probably can't give definitive guidance, but can at least speak to how the Risk Management Framework can be used in shorter turnaround cycles. Might also be a good place to mention DevSecOps and Continuous Monitoring (ConMon).

• https://18f.gsa.gov/2018/07/19/taking-the-ato-process-from-6-months-to-30-days/
• https://medium.com/@NickSinai/ato-in-a-day-fd53f0ef4a5d