The FedRAMP Marketplace is a searchable database of FedRAMP certified cloud services, authorizing agencies and recognized assessors. Before relying on a vendor, check that the exact service you will use is listed, note its status and authorizing agency, and confirm the listing covers the features and region you need.
What the site says
On 19 October 2026 the FedRAMP home page described the Marketplace as a searchable database of "FedRAMP certified cloud services, authorizing agencies, and FedRAMP recognized assessors." It showed 544 total services, 32 of them FedRAMP 20x certified. Those counts change, so check the live page. The site is run by the General Services Administration's Technology Transformation Services.
A five step check
- Find the exact offering. Vendors have many products. Authorization applies to a defined service, not the company.
- Read the status. Note whether it is listed as in process or authorized, and the level.
- Check the authorizing agency. It tells you who accepted the risk.
- Check the boundary. A listing covers specific components. Features outside the boundary are not covered.
- Check the dates. Look at the authorization date and any recent updates.
Status labels can change, so read the live listing rather than relying on an old explainer.
What a listing does not tell you
- Whether your use fits the boundary, for example a beta feature or a plug-in
- Whether your agency or program accepts that authorization for your data
- Whether the vendor meets your own contract terms on incident reporting and data location
- Which controls are the customer's job. Authorizations normally split responsibility between provider and customer, so you still own your side. Our post on the split: SaaS shared responsibility.
Ask the vendor for these
A pointer to the listing, the current boundary description, the customer responsibility split and a contact for security questions. A vendor that is authorized should find these easy to provide.
If the vendor is not listed
Ask whether it is in process and with which agency. Treat marketing phrases like "FedRAMP ready" or "aligned" with care. Alignment is a claim by the vendor. Authorization is a decision by an authorizing body. Check which one you are reading.
Record what you decided
Write a short note in the vendor file: the service name, why its boundary fits your use, who approved it and when you will check the listing again. If the vendor later changes its offering or loses its status, that note tells you what to re-test.
For each customer responsibility, assign an owner on your side before go live. Gaps usually appear where both parties assume the other one handles logging, access reviews or incident contact.
Keep your own record
Save a dated copy of the listing details in your vendor file. Listings change, and you want to show what you saw when you chose the vendor.
Quick check
Does a listed vendor cover everything it sells?
No. Authorization applies to the defined service and its boundary. Confirm the exact offering and feature set.
Who runs the FedRAMP website?
The General Services Administration, through its Technology Transformation Services, per the site.
Safeguard's compliance and evidence automation can keep vendor records and review dates together. This post makes no claim about Safeguard's own authorization status. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
