FedRAMP statistics

Rules file. FedRAMP publishes its rules as one JSON file in the FedRAMP/rules repository. This page reads that file directly, so a new release appears here without anyone at Boundera acting. Release 2026.11.02.01 was published 2026-11-02 and last confirmed on 2026-11-06. Nothing on this page is typed in: the page and the JSON are rendered from the same computation over FedRAMP's files.

How current this page is. FedRAMP cannot notify anyone when a file changes, so this site's server asks: every 5minutes, whether or not anyone is reading, it checks whether FedRAMP's files changed and downloads only a file that did. Readers get the copy in memory and never wait on FedRAMP. A new file reaches this page within about 10 minutes of FedRAMP publishing it, including up to 5minutes at FedRAMP's file host. The page cannot be ahead of those files, and FedRAMP's Marketplace website can change before its export does. If FedRAMP cannot be reached, the page shows the last copy it has and says so at the top.

Consolidated Rules. Every rule id in the file's rule process documents, across all three applicability buckets (shared by Rev5 and 20x, 20x only, Rev5 only). A rule listed under two buckets counts once. Rulesets are the rule process documents themselves, such as Vulnerability Detection and Response. The addressee table counts a rule under each party FedRAMP lists in its "affects" field.

Key Security Indicators and definitions. Indicators are counted under their families as the file lists them; indicators FedRAMP has retired are not in the file and are not counted. Definitions are the entries of the FedRAMP Definitions section.

Rev5 controls. The file's controls section lists the NIST SP 800-53 Rev5 controls for which FedRAMP still publishes its own guidance or parameter values. The tile counts those entries; the note splits them by which of the two they carry.

Release history. Boundera keeps a copy of each release it has shipped, and the last row is FedRAMP's current release when it is newer. Consecutive rows are compared by rule id: added and removed are ids that appear or disappear; reworded means the id exists in both and its published text differs (the statement, its class-specific variants, notes, lists of required information, examples, corrective actions or artifacts). Changes only to control mappings, defined-term links, timeframes or the change history are not counted as rewording. FedRAMP can publish releases between two rows, and their changes then count together in the later row. The first row has no comparison.

Marketplace export. FedRAMP publishes a log of every certification status change per listing, fedramp-status-changelog.json, in its public Marketplace data repository, and updates it more than once on most days. This page shows the export's own timestamp. A listing's current designation, program and class are those of its latest entry (by transition date, then by the date FedRAMP recorded it, then by position in the file). Labels are FedRAMP's own: "Rev5", "20x Pilot" and "20x" for the program, "Class A" to "Class D" or "Unknown" for the class, and the designations as written.

Certified offerings. Listings whose latest entry is the designation "FedRAMP Certified", the term the Marketplace now uses where its legacy data says "FedRAMP Authorized". The count is of offerings: one provider can hold several. Listings "FedRAMP Certified (In Remediation)" keep that label and are counted apart.

New certifications per month. Every entry that moves a listing into "FedRAMP Certified", counted in the UTC month of its transition date, including a return from remediation or a conversion from one program to another; delisted offerings keep their past certifications in the series. Fiscal years run from October to September. By this method FY2026 has 108 moves into the designation (82 Rev5, 22 20x Pilot, 4 20x). FedRAMP's own fiscal year 2026 summary of 2026-10-08 reported 92 new certifications (66 Rev5, 26 20x). FedRAMP has not published how it counts, so both figures are given.

Cross-check with the Marketplace website. On 2026-11-02 the Marketplace products page showed the same number of FedRAMP Certified offerings as that day's export and two fewer Initial Implementation listings: those two had a status in the log but no product page. Delisted listings never appear on the Marketplace page but keep their last entry in the log, which is why the log holds more listings than the page. The page labels "FedRAMP Ready" listings "Legacy FedRAMP Ready".

What this page does not do. It counts and lists. It does not rank, grade or compare providers, and it uses FedRAMP's own labels throughout.