Marketplace listing · Consolidated Rules 2026

List your cloud service for free.

Get your FedRAMP-compatible Trust Center and machine-readable package. Publish both, add your Trust Center to your website, then submit FedRAMP’s official request.

List for free View Trust Center

Free to publish and apply. Marketplace Entry starts at $5k/yr only when you want to begin making certification changes.

Clear ownership: Boundera generates and checks the package. You publish, review, and submit it. FedRAMP decides listing and certification status.

trust.boundera.io/boundera-demo-cloud

Boundera Demo Cloud

Trust center

Pending

Continuously monitored

12 key security indicators

Service model

SaaS

Deployment

Public Cloud

Security category

Moderate

Business category

Cybersecurity & Risk Management

About this service

Boundera Demo Cloud demonstrates how provider-authored Marketplace information can be published in human-readable and machine-readable formats. No production customer or authorization data is shown.

Services

Core workspace

ModerateIn scope

Public API

ModerateIn scope

Reporting service

ModerateIn scope

Status page

LowOut of scope

Machine-readable package · example JSONPowered by Boundera

One source of truth

{
  "serviceIdentification": {
    "serviceName": "Boundera Demo Cloud"
  },
  "serviceProperties": {
    "serviceType": ["SaaS"]
  }
}

Required before certificationFRC-APP-MLFMKT-CSO-PMLMKT-CSO-MLRMKT-IIP-AGUMKT-IIP-DCP

Rules reviewed August 8, 2026Read the FedRAMP source

What you receive

One record. Two audiences.

Agency buyers need a clear public explanation. FedRAMP’s systems need structured data. Boundera keeps both outputs tied to the same provider-reviewed facts.

Provider-reviewed offering facts

Scope · services · contacts · milestones

Human-readable

Public Trust Center

Machine-readable

Certification Package JSON

Public Trust Center

A clear, hosted record of your offering, scope, services, and certification progress for agency buyers.

Machine-readable package

Certification Package Overview JSON generated from the same facts and checked against the published schema.

Submission-ready answers

The exact provider-authored answers and links needed to complete FedRAMP's official request form.

Boundera prepares

Guided inputs, public Trust Center, JSON package, service scope, and quarterly progress surface.

You review and submit

Your team confirms every fact and sends the official provider request using its own authority.

FedRAMP decides

Only FedRAMP can approve a Marketplace listing or determine certification status.

The path to submission

Three moves from facts to form.

The official request stays in your hands. Boundera organizes the inputs, publishes the public record, and gives your team submission-ready answers and URLs to review.

01
Confirm the use case
Document the direct or indirect federal use case and collect the offering facts that already exist.
02
Publish the record
Review and publish the Trust Center, service scope, machine-readable package, and quarterly milestones.
03
Submit to FedRAMP
Use the prepared answers and URLs to submit the official provider request yourself.

Eligibility comes first

Show how federal agencies will use the offering.

A compliance goal alone is not the use case. Your request should describe one of the two ways the cloud offering will support a federal system.

MKT-IIP-AGU

Direct use

An agency will use the offering directly as part of a federal information system and issue its own authorization to operate.

Indirect use

Another cloud service offering used by agencies will include your product as a third-party information resource.

Read the requirements

The public record, rule by rule.

These are the Marketplace-listing requirements Boundera helps your team turn into visible evidence. Expand each item for the practical meaning.

Review the official rules

01FRC-APP-MLFMarketplace listing comes first

A provider must obtain an Initial Implementation Phase Marketplace listing before applying for FedRAMP Certification.

02MKT-CSO-PMLSubmit the official provider form

The provider submits FedRAMP's Marketplace Provider Listing Request Form. Applications are not accepted by email.

03MKT-CSO-MLRPublish the required information

Address the public Certification Data requirements in human-readable and machine-readable formats.

04MKT-IIP-AGUShow an eligible federal use case

Explain whether agencies will use the offering directly or through another cloud service offering.

05MKT-IIP-DCPDemonstrate continuous progress

Publish progress against real certification goals and update it at least quarterly.

CDS-CSO-PUBThe sixteen public information fieldsPublish each item when it is available and applicable.

FedRAMP ID
Service Model
Deployment Model
Business Category
UEI Number
Sales Contact Information
Security Contact Information
Product Website Link
Link to Product Logo
Overall Service Description
Detailed service list with security categories
Link to Secure Configuration Guidance
Overview of supplied documentation
Trust Center landing page link, with access instructions
Next Ongoing Certification Report date
Current FedRAMP Recognized independent assessment service

Ready to send the official request?

Your organization submits this form directly to FedRAMP.

Open provider request form

The certification runway

Listing is the start line, not the finish.

Your public record should keep showing real progress. For Class B, C, or D certification, the rules require evidence that an assessment is scheduled within two years of the initial listing.

01
Day 1
Initial listing
02
At least quarterly
Public progress update
03
By month 24
Assessment scheduled for Class B, C, or D

Boundera keeps the public surface and quarterly evidence in one place; your team remains responsible for accurate milestones and the assessment schedule.

Common questions

Straight answers before you start.

No guaranteed approval dates, invented readiness scores, or blurred ownership.

01How long does it take to prepare a FedRAMP Marketplace listing?

Preparation time depends on how complete your offering facts, service scope, contacts, and public links are. Boundera prepares the package for your review, but FedRAMP controls its own review time and Boundera does not promise an approval date.

02Do I need an independent assessor or security assessment to get listed?

No assessment is required for the Initial Implementation Phase listing itself. For Class B, C, or D certification, the rules require evidence of a scheduled assessment within two years of the initial listing.

03How much does a FedRAMP Marketplace listing cost?

Creating and publishing your Marketplace listing with Boundera is free and does not require a card. Marketplace Entry is $5,000 per year when you are ready to start making the security and engineering changes needed for certification; that plan fee credits toward an upgrade.

04Does Boundera submit the request for us?

No. Boundera prepares and hosts the package, and your team reviews it and submits FedRAMP's official request. FedRAMP alone decides whether to list or certify an offering.

05Do we need all sixteen public information items on day one?

No. Publish the items that are available and applicable, keep them current, and add fields such as a FedRAMP ID or assessor when they become real.

06Does a CMMC requirement make our offering eligible?

Not by itself. The offering must still support direct or indirect federal agency use. A private-sector compliance need without a federal use case is outside FedRAMP's Marketplace scope.

Self-serve listing