Marketplace Listing¶

FedRAMP MUST include a summary with any Marketplace listing decision that explains why the decision was made, including an explanation of deficiencies if applicable.

FedRAMP MUST NOT list cloud service offerings in the Marketplace or perform any FedRAMP Certification activities unless it determines the cloud service offering is within the scope of FedRAMP.

Reference: Scope of FedRAMP

Terms: Cloud Service Offering

FedRAMP MUST publish and maintain JSON schemas for required machine-readable Marketplace web information supplied by advisors and assessors.

Reference: FedRAMP JSON Schemas on GitHub

Terms: Machine-Readable

Providers MUST demonstrate that a cloud service offering is intended for one of the following use cases:

1. Direct Use: The product will be used directly by agency customers for integration into a federal information system that falls within the scope of 44 USC § 3506 and will receive an agency Authorization to Operate.
2. Indirect Use: The product will be included as a third-party information resource in other cloud service offerings that are directly used by agency customers.

Notes:

• FedRAMP will not list products or services that are outside the explicit statutory scope of FedRAMP; See MKT-FRP-SOF (Scope of FedRAMP).
• Services used by private companies to meet other compliance requirements (such as CMMC) that do not also meet one of the above use cases are outside the scope of FedRAMP.

Terms: Cloud Service Offering, Information Resource, Third-Party Information Resource

Providers MUST complete the Provider Listing Request Form at https://fedramp.gov/forms/provider-listing-request/ in full to request listing in the FedRAMP Marketplace.

Reference: FedRAMP Marketplace Provider Listing Request Form

Assessors MUST obtain and maintain FedRAMP Recognition to be listed in the FedRAMP Marketplace.

Terms: FedRAMP Recognized

Assessors MUST have an appropriate web site that publicly supplies at least the following information in consistent machine-readable and human-readable formats:

1. General description of the independent assessment service
2. Contact information
3. Types of independent services offered
4. Optional: Positive attestations from customers or customer references

Terms: Machine-Readable

Assessors MUST complete the Assessor Listing Request Form at https://fedramp.gov/forms/assessor-listing-request/ to request listing in the FedRAMP Marketplace.

Advisors MUST have an appropriate web site that publicly supplies at least the following information in consistent machine-readable and human-readable formats:

1. General description of the consulting or advisory service
2. Contact information
3. Types of consulting or advisory services offered
4. Optional: Positive attestations from customers or customer references

Terms: Machine-Readable

Advisors MUST complete the Advisor Listing Request Form at https://fedramp.gov/forms/advisor-listing-request/ to request listing in the FedRAMP Marketplace.

Advisors MUST reply to all requests from @fedramp.gov or @gsa.gov email addresses sent to the contact information provided in their advisor listing within 5 business days.

Providers MUST implement a minimum set of rules to be listed in the FedRAMP Marketplace during the Preparation Phase, including at least:

1. CDS: rules
2. CCM: rules

Providers MUST demonstrate continuous progress towards FedRAMP Certification, documented in their quarterly Ongoing Certification Reports; progress is measured by the provider against documented goals and milestones.

Note: This is an opportunity for a business to showcase its goals and progress, and should be seen as a marketing and customer experience challenge instead of a compliance challenge.

Terms: Ongoing Certification

Providers MUST demonstrate that an assessment for a FedRAMP Certification Class B, C, or D has been scheduled within 2 years of initial listing in the Preparation Phase