On February 20th, the FedRAMP PMO announced the release of the newest design for the FedRAMP Marketplace. While this news doesn’t necessarily shake the foundations of government compliance, the Marketplace it is an essential resource for agencies looking for a trustworthy source of information regarding cloud providers.

In this article, we’ll break down what kind of information you can find in the new Marketplace and highlight why this resource is so vital for the health and performance of the program.

What Is the FedRAMP Marketplace?

The FedRAMP Marketplace lists relevant agencies related to the FedRAMP authorization process. This easy-to-navigate directory is critical for organizations getting into FedRAMP compliance from any direction (assessment, agency work, or cloud service provision). It works as a prevention method and provides a level of transparency that any government program should strive for.

Currently, three primary categories are listed in the Marketplace: agencies, products, and assessors.

Agencies

This directory lists government agencies that work with cloud products that have been authorized. A federal agency listing will include their website, a list of their product authorizations, and contact information for an agency liaison.

Products

This section is confusing when it comes to terminology. The directory lists cloud “products.” That is, it provides information on a specific cloud platform or solution (whether software, infrastructure, or other platform capabilities). However, these products are organized by a Cloud Service Provider (CSP)–that is, the company that provides the product itself.

So, for example, you might get confused over the fact that IBM might have several listings in the directory. It’s important to note that in this example, IBM will have a multiple entries, one for each product, and that different agencies may use one or more of those products. Each product must be authorized individually. However, the same company undergoes the authorization process. 

Because of this, it’s often the case that people will refer to FedRAMP authorization as a process targeting either CSPs or cloud products specifically. 

When browsing the Marketplace, you’ll be able to see the following information for each product listing:

• Cloud Service Provider (CSP) Name: The name of the company or organization that offers the cloud service.
• Cloud Service Offering (CSO) Name: The specific name of the product or service being offered.
• Service Model: The type of service being offered, which could be Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), or Software-as-a-Service (SaaS).
• Deployment Model: How the cloud service is deployed. This could be a Public, Private, Community, or Hybrid Cloud.
• Impact Level: The FedRAMP security impact level the cloud service has been authorized to handle. This could be Low, Moderate, or High, representing the potential impact on an organization’s operations, assets, or individuals should there be a security breach.
• Authorization Status: The current status of the CSP’s FedRAMP authorization process. This can indicate if the service is “FedRAMP Authorized,” “FedRAMP Ready,” or “FedRAMP In Process.”
• Date of Authorization: The date when the CSP achieved its FedRAMP authorization for the particular service.
  
• Agency Sponsor: The name of the federal agency that sponsored the CSP’s FedRAMP authorization process (if any).
  
• Third-Party Assessment Organization (3PAO): The independent organization that conducted the assessment of the cloud service’s security controls.
  
• Package Access Status: The availability of the CSP’s Security Package, which includes the System Security Plan, Security Assessment Report, and Plan of Action and Milestones. Note that access to these documents requires a valid federal government email address and is provided on a need-to-know basis.

Assessors

Third-Party Assessment Organizations (3PAOs) are critical in the FedRAMP process. They provide independent validation of security controls implemented by Cloud Service Providers (CSPs). 

The FedRAMP Marketplace lists approved Third-Party Assessment Organizations (3PAOs). These organizations assess Cloud Service Providers (CSPs) compliance with FedRAMP’s security requirements.

Each 3PAO listing on the FedRAMP Marketplace usually includes the following information:

• Company Name and Description: The name of the 3PAO and a description of their mission and capabilities (typically written by the company).
• Point of Contact: This could be the name, email, and phone number of the person responsible for coordinating the assessments. This also includes the physical address of the company and its founding date.
  
• Accreditation Date: The date the 3PAO received its accreditation.
  
• Products Assessing: The Marketplace will give readers a count of all products the assessor is or has assessed, along with the status of that assessment (Authorized, In Process, Ready).
• Additional Cyber Frameworks: The listing will also provide other frameworks that the assessor may provide services for, such as ISO, HIPAA, SOC 2, PCI DSS, or FISMA.

Why Is a Robust Marketplace Website So Important to FedRAMP?

The FedRAMP Marketplace serves several key purposes in the federal cloud computing ecosystem:

• Showcase Authorized Products: It lists all Cloud Service Providers (CSPs) and their offerings that have achieved FedRAMP authorization. This gives federal agencies visibility into the cloud services that meet the stringent security requirements of FedRAMP.
  
• Transparency: By providing essential details about each offering, such as the service model, deployment model, security impact level, authorization status, and sponsoring agency, the Marketplace promotes transparency in the federal cloud space.
  
• Promote Reusability: Once a CSP achieves a FedRAMP authorization, that authorization can be reused by any federal agency. The Marketplace enables this reusability by serving as a central, publicly accessible repository of authorized cloud services.
  
• List of Trustworthy Assessors: The Marketplace also lists Third-Party Assessment Organizations (3PAOs). These organizations perform independent validation of a CSP’s security controls. This helps CSPs seeking FedRAMP authorization to identify and select a suitable 3PAO.

Overall, the FedRAMP Marketplace is designed to facilitate the adoption of secure cloud services across the federal government, reducing duplicate efforts, inconsistencies, and cost inefficiencies associated with the traditional security authorization process.

Work With a Trusted FedRAMP 3PAO: Lazarus Alliance

Yes, that’s right: We’re also on the FedRAMP Marketplace. And for good reason. We see FedRAMP is the future of compliance in the federal sector, and as cloud products expand in influence, they will be a factor in federal government infrastructure. 

To learn more about Lazarus Alliance and our FedRAMP 3PAO services, make sure to contact us.