Recounting my experiences from the biggest customer (the federal government), everything costs a million plus because you have to have so many bodies to support it. Aside from the obviously unnecessary committee meetings in which a panel of stakeholders spend four hours debating the minutiae of a website (font, colors, stock photo selection, the usual), you have to have an "architect" to navigate the bureaucratic process of getting DNS entries, database tables and backup systems hooked up because you can't possibly bring your own.
You have to have at least one developer who makes sure that its authentication uses CAC, X.509 or at least Active Directory as its authentication source. You have to have at least one specialist developer who ensures that logs and audit trails are DCAA compliant.
You have to have at least one developer to ensure that the website is 509 compliant.
So on and so forth, and that's not even counting however many developers you need to actually build the basic functionality they've hired you to build.
On top of that, you need to have a proposals team capable of submitting a proposal to an FBO request for proposal, a contracts lawyer to ensure that you're meeting the contract terms with the technical solution you're providing, an accounts payable & accounts receivable team to team up with the contracts lawyer to figure out how to prove to the government that you actually delivered the module or widget they're insisting is deficient so that they can slough off paying you for as long as possible because they're in continuing resolution, a veteran / minority / woman / disadvantaged person with ownership stake to be eligible for program 8A opportunities, a project manager to actually manage the work, a program manager to try and upsell the opportunity and keep their ear to the ground to get the insider details on potentially up and coming work that they can pass to the proposals team, and a subcontractor with some kind of past qualifications in government work that you can leverage to ensure the government that you are, by proxy, also qualified to do that kind of work for that kind of government agency.
And of course, with the myriad, competing interests of the various stakeholders, a Herculean degree of risk aversion, and the fact that everybody wants you to fail, including the customer who didn't sign on to a risky project that will likely fail so are duty bound to ensure that it does fail and especially your "support team" of people who you have to ask for DNS entries, database tables, etc. that are actually competitors of yours that also bid on the work but obviously failed to win, they just want you to fail so the contract can get re-bid and they have another shot at winning it.
Of course, that's not the worst part - the worst part is if and when a project appears likely to succeed despite all the attempts at ensuring it doesn't? Then everybody and their mom becomes "active" stakeholders in your project because it's a chance to hitch their wagon up to a success that they can put on their resumes to get promoted... they want you to customizer your project to suit their needs so they can put their stamp on it so it provides a clear and measurable benefit to their division / department even though this work is clearly ad hoc, not in the contract, and they're extremely unlikely to want to pay you for it because of that.