FedRAMP 20x: Make Public JSON Work in Agency Web Tools

Your public certification JSON downloads, and its contents pass a schema check. Before calling delivery ready, check the experience described by FedRAMP: a web application on another domain can retrieve and use the public data with normal browser protections in place.

For 20x Class B and C teams, this is a coordination task for application engineering and the owner of public certification information. The October 5 clarification addressed public JSON compatibility and the public product-logo link. It did not make every certification document public or establish a new blanket adoption deadline.

Check structure and web delivery separately

FRC-CSO-JSN says providers MUST supply machine-readable information in JSON documents valid against the corresponding FedRAMP schema when a rule provides one, unless that rule specifies otherwise. It also says public JSON MUST be delivered compatibly with modern web frameworks.

The rule’s accompanying guidance identifies these delivery expectations:

JSN also notes that FedRAMP’s Schema Validator will not work properly when CORS is incorrectly configured. Treat a schema result and a browser-delivery result as different evidence. A saved document’s structure does not demonstrate the deployed endpoint’s complete delivery behavior.

Exercise the public endpoint from a browser application

The following is an editorial engineering check, not an extra FedRAMP test form or prescribed monitoring schedule:

1. Identify the public data. Confirm the endpoint serves the intended public certification information and record the exact URL and version under test.
2. Check the applicable schema. Validate the JSON against the corresponding schema, preserving JSN’s exception when the underlying rule specifies otherwise.
3. Use an application on another domain. Have a small browser-based test application retrieve and parse the public JSON with normal security settings. Merely opening the JSON URL is not this proposed cross-origin application test.
4. Inspect the delivered response. Check the listed content headers and whether the test application can read the intended public fields. If it cannot, retain the observed failure and investigate the delivery configuration.
5. Retest the deployed result. After a correction, repeat the same application retrieval and record what changed.

For a handoff, retain the schema result, endpoint, test application’s origin, response-header observations, browser result and release owner. These are suggested engineering records. They help the next operator reproduce the check without turning a local success into a claim of certification.

Include the logo in the delivery check

CDS-CSO-PUB calls for up-to-date public offering information in human-readable and JSON formats, including its listed information that is available and applicable. Among those items is a product-logo link.

The logo link is to be a valid, properly named image link that displays in a browser without processing. Transparent PNG is preferred, not mandatory. As a practical check, open the exact logo URL carried in the public data and confirm the image displays; a page that contains a logo is not the same deliverable as the specified image link.

Preserve the public and restricted access boundary

Apply these public-delivery checks to public information. They do not justify opening restricted package materials or prescribing a wildcard CORS policy for private endpoints. CDS separately addresses access to certification materials and conditional responsible public package sharing. Keep those decisions with the people responsible for the material and its access policy.

For both FRC and CDS, the 20x optional-adoption and initial-certification dates are July 4, 2026. Ongoing certification uses January 1, 2027; grace ends at the first FedRAMP independent assessment started after that date. October 5 is the clarification date.

Common release questions

Does valid JSON establish browser compatibility?

JSN addresses both schema validity and public web-framework compatibility. Check both; a structural result alone does not demonstrate the delivery expectations.

Does the public logo have to be a transparent PNG?

No. CDS-PUB prefers transparent PNG, while specifying a valid, properly named image link that displays in a browser without processing.

For adjacent work, see JSON schema validation and testing trust-center programmatic access.