The FedRAMP Marketplace: Reading Cloud Authorization Status for Teaming

If your solution runs in the cloud, or you need a partner whose software does, FedRAMP decides how fast an agency can use it. The Federal Risk and Authorization Management Program is the Government-wide standard for assessing and authorizing cloud services, run by GSA and written into law by the FedRAMP Authorization Act (44 U.S.C. 3607 to 3616). The public FedRAMP Marketplace (marketplace.fedramp.gov) is the authoritative list of where each cloud offering stands.

The three Marketplace statuses#

Each listing also shows the impact level (Low, Moderate or High, plus a tailored baseline for low-risk software), the authorizing agencies and the date of the last status change.

Why it matters for defense work#

Civilian agencies generally require a FedRAMP authorization before they put federal information in a commercial cloud. In defense work the requirement reaches contractors too: DFARS 252.204-7012 requires that a cloud service a contractor uses to store, process or transmit covered defense information meet security requirements equivalent to the FedRAMP Moderate baseline, with incident reporting and media preservation obligations on top. DoD also applies its own cloud impact levels for its own systems, which build on the FedRAMP baselines.

That makes FedRAMP status a teaming question:

• A prime proposing a software solution needs to know whether the partner's offering is already authorized, or how long it will take
• A subcontractor handling covered defense information in a SaaS tool needs that tool to meet the Moderate equivalent
• Reusing an existing authorization is far faster than sponsoring a new one

Reading a listing correctly#

1. Search the Marketplace for the exact offering name, not just the company.
2. Confirm the status and impact level match what your requirement needs.
3. Note the authorizing agencies; an agency that already uses the service is a strong reference.
4. For In Process or Ready listings, ask the provider for its timeline and agency sponsor, and plan for the gap.
5. Keep the listing date in your proposal file. FedRAMP is modernizing its process, so statuses and paths can change.

Questions to ask a cloud partner#

Before you write a partner's cloud service into your solution, ask for answers in writing:

• Which exact offering and impact level is listed, and which agencies authorized it?
• Which parts of the proposed solution run outside the authorization boundary, such as support tools, analytics or a different region?
• Who handles incident reporting to you and to the Government, and how quickly?
• If the offering is In Process or Ready, who is the agency sponsor and what are the remaining milestones?

Gaps found now are much cheaper than gaps found by an evaluator.

How TeamingIndex helps#

• Each night we read the official FedRAMP Marketplace data and show a "FedRAMP Marketplace" badge on the profile of the company that offers the service, with the status, impact level, authorizing agencies and the as-of date.
• Marketplace data takes precedence over a company's own claim: a self-attested status is shown as self-attested, next to the Marketplace record, never styled as verified.
• Use the FedRAMP filter to find partners with Authorized, In Process or Ready offerings. Read the CUI guide and the CMMC overview for the rest of the cyber picture.