FedRAMP Marketplace: How to Read a Listing in 2026

FedRAMP Marketplace: How to Read a Listing in 2026

The FedRAMP Marketplace is the U.S. government's official list of cloud services that hold a FedRAMP Certification, or are working toward one. FedRAMP calls it "the authoritative repository that lists all cloud service offerings that have an active FedRAMP Certification and those that are close to doing so" (fedramp.gov).

If you last looked at the FedRAMP Marketplace a year ago, most of what you remember has changed.

It moved to a new address. "FedRAMP Authorized" became "FedRAMP Certified." Low, Moderate and High became Classes A to D. FedRAMP Ready was retired. Listings now carry a Type, a Path, a Phase and a Certification History log.

Plenty of guides, vendor pages and procurement checklists still describe the old version.

This guide explains what each part of a FedRAMP Marketplace listing means today, in FedRAMP's own words, and what a listing does and does not tell you. Every rule and quote below was read on fedramp.gov and other government sites on 2026-10-29.

What the FedRAMP Marketplace Is, and What It Is Not

Its current home is fedramp.gov/marketplace. A banner on the new site says it plainly: "the old marketplace at marketplace.fedramp.gov has been deprecated. All paths will permanently redirect to fedramp.gov/marketplace." FedRAMP's changelog dates the new Marketplace to 2026-03-11.

Three things the Marketplace is not:

1. Not an endorsement. OMB's FedRAMP memo, M-24-15 (July 25, 2024), says a service is FedRAMP authorized once the FedRAMP office approves it "for inclusion in the Marketplace," and adds: "A FedRAMP authorization is not an endorsement of a product or service."
2. Not an ATO. The Marketplace's quick start guide puts it this way: "A FedRAMP certification certifies that there are adequate security materials available for an agency to use in their own Authorization to Operate (ATO) decisions - FedRAMP does not grant ATOs." Each agency still signs its own.
3. Not a price list. FedRAMP's public notice NTC-0005 says it "will not request, store, or publish pricing information for cloud services, independent assessors, or advisory services on the FedRAMP Marketplace."

How big is the FedRAMP Marketplace? FedRAMP's fiscal-year review, published 2026-10-08, says the program "ended the year with a total of 538 FedRAMP Certified cloud service offerings" at the close of FY26 (September 30, 2026), after issuing 92 new certifications that year. The live Marketplace keeps changing after that date, so check the current count on the site rather than quoting a number from a vendor deck.

What Changed in 2026

Most confusion about the FedRAMP Marketplace comes from old terms. This table maps them.

The rename came out of a public comment request, RFC-0020. FedRAMP published the outcome in NTC-0004: "The single official label for all FedRAMP authorizations will be FedRAMP Certification or FedRAMP Certified." The changelog entry for 2026-05-04 records the switch: "Changed all designations from 'FedRAMP Authorization' to 'FedRAMP Certification', and all designations of impact levels to certification classes A, B, C, and D." The other renames come from FedRAMP's summary of the 2026 changes and its definitions page.

Why rename at all? FedRAMP's explanation: "Using FedRAMP Certification avoids conflating a FedRAMP authorization with an agency authorization to operate (which has a separate meaning as defined by OMB Circular A-130)" (fedramp.gov).

The law still says "authorization"

The statute did not change. The FedRAMP Authorization Act, codified at 44 U.S.C. 3607 to 3616, still defines a "FedRAMP authorization" (and defines it as "a certification that a cloud computing product or service has" completed the FedRAMP process). FedRAMP has said the two terms mean the same thing for legal purposes: "Any cloud service with a FedRAMP Certification is FedRAMP authorized for the purposes of meeting statutory or regulatory requirements" (NTC-0004).

So if a contract clause, a state law or a customer questionnaire asks whether a product is "FedRAMP authorized," a Marketplace listing that says "FedRAMP Certified" answers yes.

How to Read a Listing, Field by Field

Open any FedRAMP Marketplace product page and the header shows the same fields in the same order. Here is what two real listings showed on 2026-10-29: Secureframe, a 20x Pilot listing (FR2529360449), and AWS GovCloud, a Rev5 listing certified since 2016 (F1603047866).

Below the header sit four tabs: Overview, Agency Authorization Details, Dependent Products, and Certification History. What each field means:

• Package ID. The listing's identifier. Agencies quote it when they request the security package.
• Package access. Rev5 listings link FedRAMP's package request form. 20x listings say "Contact vendor for Package," because 20x packages come from the provider (more on this below).
• Phase. The tooltip lists three values: "Legacy FedRAMP Ready (earned FedRAMP Ready under the legacy process, may now be pursuing a certification), Initial Implementation (standing up the offering), or Ongoing Certification (steady-state continuous monitoring and reporting)."
• Status. Where the offering stands. Covered in the status table below.
• Authorizations. "Total Authority to Operate (ATO) and/or Authority to Use (ATU) letters, including initial and reuse authorizations." This is the closest thing on the page to a measure of how widely agencies use the service. AWS GovCloud shows 84.
• Certification Profile. Per the tooltip: "its Type (20x or Rev5), its Path (Program or Agency), and its Class," which runs from A to D, "reflecting documentation and ongoing reporting requirements."
• Certified Since. "The date this cloud service offering first became FedRAMP Certified."

Put together, the AWS GovCloud header reads as one sentence: a Rev5 service, first approved through the old Joint Authorization Board (JAB) route, certified at Class D (the class that replaced the High baseline) since June 2016, used in 84 agency ATO or ATU letters, with its package available through FedRAMP's request form. The Secureframe header reads differently: a 20x Pilot service on the Program path at Class C, with one ATO or ATU letter, and a package you request from the vendor directly. The contrast gives you your next questions: for GovCloud, whether any of those 84 ATO or ATU letters cover a use like yours; for Secureframe, what the vendor will send and whether it will meet its pilot deadline.

Notice the Secureframe row: the Status line says certified "as of 8/7/2025," while "Certified Since" says 6/23/2026.

The page does not explain the gap. When two dates on a listing disagree, open the Certification History tab, which FedRAMP added in July 2026 as an event log for each product (changelog, 2026-07-17), and read the events in order. That is also where you see a status change that a summary field can hide.

Two fields you may remember are gone. The Marketplace changelog says "Annual Assessment Dates have been removed from product pages" and "The Authorizing Agency is no longer displayed on product pages." FedRAMP also stopped showing reuse metrics publicly in July 2026 (changelog).

Certification Classes A to D

Classes replaced impact levels. NTC-0004 sets out the mapping for Rev5: "Class A will be a new pilot baseline, Class B will include the current Li-Saas and Low baselines, Class C will include the current Moderate baseline, and Class D will include the current High baseline." On listings, the old level appears in parentheses, so you see "Class C (Moderate)" or "Class D (High)." FedRAMP has said only that there will be "a transition period where the old and new labels will be linked," without publishing an end date.

What each Class is good for, from FedRAMP's guidance on choosing a class:

Two cautions. First, the same page says the match is loose: "FedRAMP Certification Classes loosely align with the baseline security expectations for these impact levels," and "There is not a direct correlation between FedRAMP Certification Class and Impact Level."

So read "Class C" as "replaced the Moderate baseline," not as "rated Moderate impact." Second, FedRAMP dropped the word "levels" on purpose, "to avoid confusion with the DOD/DOW Impact Level/IL system" (NTC-0004). A Class D listing is not a DoD IL5 authorization. Those are separate programs.

Type and Path: Rev5, 20x, Program, Agency

Type says which rulebook the service was certified under. FedRAMP's definitions put the difference in one line: "Rev5 follows a legacy approach based primarily on documented plans while 20x follows a modern approach based primarily on measured outcomes." 20x measures security through Key Security Indicators instead of long control narratives. You will see three values:

• Rev5. The traditional path built on the NIST SP 800-53 controls.
• 20x. The newer path. Per FedRAMP's page on certification types, 20x certifications "are processed directly by FedRAMP and do not require an active agency contract or sponsor."
• 20x Pilot. Services certified during the 20x pilot. The Marketplace began showing this label on 2026-10-21 "to help distinguish vendors certified under the 20x Pilot program from those with full 20x certification" (changelog). Pilot listings must catch up with the full rules. Secureframe's listing data, for example, says it must "implement all required rules by March 7, 2027" to keep its listing and lose the pilot label.

Path says who stood behind the certification. Under the 2026 rules there are two: Program (FedRAMP itself certified the service) and Agency (a sponsoring agency's ATO, reviewed by FedRAMP). The definitions page calls the Agency path "a legacy path that is only available for FedRAMP Rev5," and 20x services "automatically proceed on the Program Certification Path" (path guidance).

You will also see a third value, JAB, on older listings such as AWS GovCloud and Azure Government. M-24-15 describes the JAB provisional ATO as part of "the prior FedRAMP policy structure" and said existing JAB provisional authorizations "will be re-designated as determined by the FedRAMP PMO in collaboration with the CSP." Until that shows on a listing, "Path JAB" means the service was originally approved through the Joint Authorization Board.

What Each Status Means

The first five stages come from the tooltip on every listing. FedRAMP added "FedRAMP Certified (In Remediation)" on 2026-07-17, together with a separate Corrective Action Plan notice: "When a vendor is operating under a Corrective Action Plan, product pages display a clearly labeled CAP notice that is separate from the overall certification status" (Marketplace changelog). A "FedRAMP Certified" status with a CAP notice next to it is not the same as a clean listing. Read both.

FedRAMP Ready deserves a note because it still shows up in sales material. The FedRAMP timeline says: "July 28, 2026 FedRAMP Ready goes Legacy: No FedRAMP Ready submissions will be accepted after this date; providers should seek FedRAMP 20x Class A Certification instead."

A vendor who says "we are FedRAMP Ready" holds a legacy status, not a certification. FedRAMP opened a temporary "Lost Sponsor/Ready Conversion" pipeline on August 10, 2026, covering Class B and Class C. It is open only to providers that met one of four listed conditions "between January 2025 and March 2026," such as achieving FedRAMP Ready on the Marketplace or completing a FedRAMP Ready assessment in that window, and FedRAMP must confirm eligibility first (path guidance). Ask which pipeline the vendor is in and when it expects a decision.

How an Agency Uses a Listing

The Marketplace's quick start guide describes the buyer's steps: search and filter by Class and status, contact the vendor, then "Using the package ID, submit a package request form to access more security documentation." Its last step is easy to skip: "Verify current certification status: Ensure certification status has not changed before finalizing any agreements."

How you get the package depends on the Type:

• Rev5 packages go through FedRAMP's Package Access Request Form. The form says "You must have a .gov or .mil email address to access a FedRAMP Security Package," and the signed form goes to package-access@fedramp.gov.
• 20x packages do not use that form. It says so itself: "Do not use this form for FedRAMP 20x package requests. For FedRAMP 20x packages, please contact the provider using the information on their Marketplace listing."

Once you have the package, the law tilts in your favor. Under 44 U.S.C. 3613(e), the security assessment in a FedRAMP package "shall be presumed adequate for use in an agency authorization to operate."

You do not redo the assessment. You still own the decision. FedRAMP's guidance for agencies says the agency's authorizing official "accepts risk for the agency's specific use of that service, including the information processed, the configuration selected, the integrations enabled, and the controls the agency is responsible for operating," and "Agencies remain responsible for issuing their own ATO or ATU even when they rely on a FedRAMP Certification."

Class does not decide your system's category either. NTC-0004 says "a FedRAMP Certification is not a guarantee that a cloud service has met all requirements to be appropriate for use by an agency at a given FIPS 199 security category," and agencies may use a package "at any security category they deem appropriate following the Risk Management Framework." The categorization work in our NIST Risk Management Framework guide still applies, and so do your agency's FISMA duties.

Checks for Companies Vetting a Vendor

Many private buyers use the FedRAMP Marketplace as a quick trust signal. Used carefully, it is a good one. Five checks take a few minutes:

1. Search the live Marketplace, not a copy. Vendor pages, analyst reports and data copies can lag. The listing on fedramp.gov is the record.
2. Match the product name exactly. A listing covers one cloud service offering. "Company X is FedRAMP Certified" may mean one product of five. The Overview tab lists the services included in the assessed scope.
3. Read the full Certification Profile. "20x Pilot, Class C (Moderate)" and "Rev5, Class D (High)" are very different statements. Match the Class to the sensitivity of what you will store.
4. Look for a CAP notice and "In Remediation." Both are shown separately from the headline status.
5. Check Dependent Products. The tab lists other Marketplace services that depend on the one you are viewing. A SaaS product built on a certified infrastructure service needs its own listing, so confirm the product you are buying has one.

If you need the data in bulk, the quick start guide says you can "Export your narrowed search as a spreadsheet (CSV) or data file (JSON)." If a vendor claims FedRAMP status for a defense contract, note that FedRAMP does not rule on CMMC: "FedRAMP does not support or provide 'equivalency'" and those questions "should be directed to the Department of War" (fedramp.gov). Our CMMC compliance guide covers that side.

How a Cloud Provider Gets Listed

Since 2026, every provider starts with an Initial Implementation listing on the FedRAMP Marketplace. The listing rules say: "All cloud service providers must obtain a Initial Implementation Phase Marketplace Listing before they can apply for FedRAMP Certification." The same rules require proof "that an assessment for a FedRAMP Certification Class B, C, or D has been scheduled within 2 years of initial listing." Initial Implementation listings opened on July 6, 2026 (timeline).

From there, the dates that matter, all from FedRAMP's timeline and deadlines page:

• August 3, 2026: 20x Class A pipeline opened. August 31, 2026: 20x Class B and C pipelines opened.
• January 1, 2027: mandatory adoption of the Consolidated Rules for 2026 (CR26).
• June 11, 2027: "FedRAMP will stop accepting any new FedRAMP Rev5 Certifications." Existing Rev5 certifications "will remain active until at least December 31, 2028" (fedramp.gov).
• February 1, 2028: all CR26 grace periods expire, and offerings "not fully following the Consolidated Rules for 2026 will lose their FedRAMP Certification."

Class A is the new entry point for companies without a federal customer yet. FedRAMP's July 30, 2026 update says: "If you have a complete FedRAMP Readiness Assessment Report or a SOC 2 Type II, you can submit for a Class A Certification when the pipeline opens."

The same update sets a clock: "Once a cloud service offering has a federal customer using their service they have 12 months to begin transition to a Class B (or higher) certification." If your SOC 2 Type II report is current, Class A is the entry route FedRAMP itself points to. For the full assessment process and costs, see the FedRAMP authorization guide.

Common Mistakes When Reading the FedRAMP Marketplace

1. Treating "Certified" as an ATO. It is the input to your ATO, not the ATO.
2. Reading the Class as a DoD Impact Level. FedRAMP chose the word "Class" to stop exactly this.
3. Trusting a "FedRAMP Ready" claim. Ready is now Legacy and closed to new submissions. It is not a certification.
4. Ignoring the Type. A 20x Pilot listing has a deadline to meet the full rules. A Rev5 listing has to adopt CR26 or lose its certification.
5. Skipping the history. The Certification History tab explains date gaps and status changes that the header does not.
6. Using the old address. Links to marketplace.fedramp.gov now redirect. Update procurement templates and vendor questionnaires that still point there.

Frequently Asked Questions

What is the FedRAMP Marketplace?

It is the official list of cloud services that hold a FedRAMP Certification or are working toward one, run by FedRAMP at fedramp.gov/marketplace. Agencies use it to find services whose security packages they can reuse for their own authorization to operate. It is not an endorsement and it does not show prices.

Is "FedRAMP Certified" the same as "FedRAMP Authorized"?

Yes, for legal purposes. FedRAMP renamed the designation in 2026, and its notice NTC-0004 says any service with a FedRAMP Certification "is FedRAMP authorized for the purposes of meeting statutory or regulatory requirements." The underlying law, 44 U.S.C. 3607 to 3616, keeps the older term.

What does "Class C (Moderate)" mean on a listing?

Class C is the certification class that replaced the Moderate baseline, and the old label is shown in parentheses during the transition. FedRAMP says Class C carries adequate information for most Low and Moderate security objectives, but warns there is no direct correlation between a Class and an impact level.

How do I get a FedRAMP security package?

For a Rev5 listing, an agency employee with a .gov or .mil email submits FedRAMP's Package Access Request Form using the listing's Package ID. For a 20x listing, you contact the provider through the details on its Marketplace listing.

Does a Marketplace listing mean my agency can use the product?

Not by itself. FedRAMP certifies the cloud service. Your agency's authorizing official still accepts the risk for your specific use and issues the agency's own ATO or ATU. The FedRAMP package is presumed adequate for that decision under 44 U.S.C. 3613(e).

How many products are FedRAMP Certified?

FedRAMP reported 538 FedRAMP Certified cloud service offerings at the end of fiscal year 2026 (September 30, 2026). The live Marketplace count changes as services are added or leave, so check the site for the current figure.

Sources Used

All accessed 2026-10-29.

1. FedRAMP Marketplace and Marketplace quick start guide
2. FedRAMP Marketplace changelog and FedRAMP changelog
3. FedRAMP: Marketplace (provider guidance)
4. Public Notice NTC-0004: FedRAMP Authorization Designations
5. Public Notice NTC-0005
6. Consolidated Rules for 2026: definitions
7. Choosing a certification class, type and path
8. Marketplace listing rules (20x)
9. FedRAMP timeline, deadlines and summary of changes
10. FedRAMP: certification paths are heating up (July 30, 2026)
11. FedRAMP: from foundation to implementation (October 8, 2026)
12. FedRAMP: how agencies use a FedRAMP Certification
13. FedRAMP Rev5 Package Access Request Form (PDF)
14. FedRAMP provider overview
15. Listings: Secureframe (FR2529360449) and AWS GovCloud (F1603047866)
16. OMB Memorandum M-24-15, Modernizing FedRAMP (July 25, 2024)
17. 44 U.S.C. Chapter 36, including sections 3607 and 3613 (govinfo)

Last reviewed: 2026-10-29. This article was prepared by the Security Compliance Guide Editorial Team. We use AI to draft initial summaries of publicly available cybersecurity compliance documentation, then verify every claim against primary sources before publication. We are not licensed auditors, attorneys, or compliance consultants. For binding decisions, consult a qualified professional. See our editorial standards for full sourcing rules.