FedRAMP Consolidated Rules for 2026
How to get listed on the FedRAMP Marketplace
The rules changed in 2026. You now get listed on the Marketplace before you pursue certification, and listing is the fast part — no assessment, no independent assessor, no agency sponsor.
The short answer
You publish a defined set of public information about your offering in human-readable and machine-readable form, show a credible federal use case, commit to quarterly progress updates, and submit the listing request form. For most teams that is days to weeks of preparation, not months.
What takes time is what comes after. A listing starts a two-year window to get a certification assessment scheduled.
Getting listed is the fast part. Staying credible for the two years after is the real program.
The 2026 inversion
Listing now comes first
Under the legacy FedRAMP process, the Marketplace was where you ended up. You appeared after achieving Ready or In Process status, already deep into a long authorization journey. The Consolidated Rules for 2026 invert this completely.
All cloud service providers must obtain an Initial Implementation Phase Marketplace Listing before they can apply for FedRAMP Certification.
Rule FRC-APP-MLF makes it a certification prerequisite in as many words: providers MUST be listed in the FedRAMP Marketplace before applying for FedRAMP Certification. A listing is no longer a status you earn late. It is the mandatory first step you take early, while you are still preparing.
There is no reason to wait
You do not need to be ready to be listed. The Initial Implementation Phase exists precisely for providers who are actively preparing to obtain a certification.
Waiting has a real cost
Agency buyers browse the Marketplace. Until you are listed you do not appear there, and your certification application cannot even begin.
Step zero
First, confirm you are eligible
FedRAMP only lists offerings inside its statutory scope (MKT-FRP-SOF). Rule MKT-IIP-AGU requires you to demonstrate one of two use cases.
Direct Use
The product will be used directly by agency customers for integration into a federal information system that falls within the scope of 44 USC § 3506, and will receive an agency Authorization to Operate.
Indirect Use
The product will be included as a third-party information resource in other cloud service offerings that are directly used by agency customers.
One explicit exclusion
Services used by private companies to meet other compliance requirements, such as CMMC, that do not also meet one of the above use cases are outside the scope of FedRAMP. If your only driver is CMMC and no federal agency will use your service directly or indirectly, a Marketplace listing is not available to you.
The requirement set
What a listing actually requires, rule by rule
Most write-ups paraphrase. This is the actual requirement chain from the Consolidated Rules — FRC-APP-MLF names four rules a provider must address, and it is shorter than you would expect.
Provider listing requests
Submit the FedRAMP Marketplace Provider Listing Request Form. FedRAMP is explicit that it does not accept listing applications by email.
Listing requirements
Address the listing's one technical gate — CDS-CSO-PUB, the public information set.
Agency use cases
Demonstrate that the offering is intended for Direct Use or Indirect Use by federal agencies.
Demonstrating continuous progress
Document progress toward certification in your Trust Center or website, updated at least quarterly against your own goals and milestones.
This is an opportunity for a business to showcase its goals and progress, and should be seen as a marketing and customer experience challenge instead of a compliance challenge.
The one technical gate
The public information set
CDS-CSO-PUB requires you to publicly share up-to-date information about your offering in both human-readable and JSON formats, with the machine-readable version validating against FedRAMP’s published Certification Package Overview schema. The rule lists sixteen items.
- FedRAMP ID
- Service Model
- Deployment Model
- Business Category
- UEI Number
- Sales Contact Information
- Security Contact Information
- Product Website Link
- Link to Product Logo
- Overall Service Description
- Detailed service list with security categories
- Link to Secure Configuration Guidance
- Overview of supplied documentation
- Trust Center landing page link, with access instructions
- Next Ongoing Certification Report date
- Current FedRAMP Recognized independent assessment service
You do not need all sixteen on day one
The rule asks for the listed information that is available and applicable. Before certification you have no FedRAMP ID and may not have engaged an assessor. Those items are not yet available and you are not expected to invent them. Publish what exists, keep it current, and fill in the rest as it materialises.
Where listings go wrong
The service list (CDS-CSO-SVC) must let a potential customer determine what is and is not in the Minimum Assessment Scope without requesting access. A vague “our platform” does not satisfy it.
And the JSON is not optional. That is the part most teams have no plumbing for, and the difference between a listing agency tooling can consume and one it cannot.
The path
From zero to listed
- 1
Confirm your federal use case
HoursEstablish whether your offering is intended for Direct Use or Indirect Use by federal agencies, and write it down in a paragraph. You will need it for the request form.
- 2
Assemble the public information items
A few daysGather every item of the public information set that is available and applicable today: UEI, contacts, service model, deployment model, description, logo, and links.
- 3
Write the service list
A few daysList your specific services and their security categories, complete enough for a reader to determine what is and is not in the FedRAMP Minimum Assessment Scope without requesting access.
- 4
Publish it human-readable and as JSON
DaysPublish the information on a public webpage or FedRAMP-compatible trust center for people, and as a schema-validated JSON document for machines. Both formats are required.
- 5
Stand up your quarterly progress page
A dayDocument real goals and milestones toward certification, and commit to updating progress against them at least quarterly.
- 6
Submit the listing request form
An afternoonSubmit the FedRAMP Marketplace Provider Listing Request Form yourself. FedRAMP does not permit a third party to apply on a provider's behalf.
Total preparation for a team that has its facts straight is days to a couple of weeks. Step four is the one that usually stalls teams, because publishing schema-valid JSON alongside a maintained public page is an engineering job rather than a document job — it is the part our listing service automates. FedRAMP’s own processing time for the request form is FedRAMP’s to set, and we will not promise numbers on their behalf.
The honest part
What a listing starts: the two-year runway
A listing is not a trophy, it is a starting gun. The day you are listed, two clocks start.
Two years to a scheduled assessment
You must demonstrate that an assessment for a Class B, C, or D certification has been scheduled within two years of your initial Initial Implementation Phase listing.
A ninety-day public drumbeat
Public, quarterly progress updates measured against your own documented goals and milestones, continuing until you certify. A stale progress page is public evidence of a stalled program.
Note which way the incentive runs. The clock only starts once you list, so delaying your listing does not buy you preparation time; it just delays the start of a window you will need all of. Both halves are true at once: listing is genuinely fast, and it commits you to a two-year program. Providers who treat the listing as the finish line end up with the worst of both — public visibility and public staleness.
After listing
Choosing your certification path
Your listing is type-agnostic. The certification decision — 20x or Rev5, which class, which path — comes when you apply. Three facts should inform it.
1 January 2027
All Consolidated Rules for 2026 requirements become mandatory for any provider seeking a FedRAMP Certification.
11 June 2027
FedRAMP stops accepting FedRAMP Rev5 certification applications.
Class A reuses what you hold
Exactly three frameworks qualify: FedRAMP Rev5 including FedRAMP Ready at any historical impact level, SOC 2 Type II, and GovRAMP at any impact level — each subject to a twelve-month recency requirement.
Our free FedRAMP 20x gap assessment gives you a rule-grounded read on your path, class, and listing gaps in about five minutes, or explore every requirement in the implementation explorer and the 2026 Rules Explorer.
Questions
Frequently asked
- How long does it take to get listed on the FedRAMP Marketplace?
- Preparation is typically days to a couple of weeks: gathering the public information items, writing an honest service list, publishing it in human-readable and JSON form, and submitting FedRAMP's request form. There is no assessment or audit in the listing step. FedRAMP's own processing time for the request varies and is not something any vendor can promise on its behalf.
- Do I need an independent assessor or a security assessment to get listed?
- No. The listing requirements include no assessment. An assessment enters the picture after listing: for a Class B, C, or D certification you must demonstrate that an assessment has been scheduled within two years of your initial Initial Implementation Phase listing.
- How much does a FedRAMP Marketplace listing cost?
- The Consolidated Rules for 2026 do not specify a fee for a Marketplace listing request. Your real cost is preparation effort and the ongoing quarterly progress commitment that follows.
- Can a consultant or advisor get us listed?
- An advisor can prepare everything, and FedRAMP anticipates providers using third parties for preparation. But rule FRC-APP-NTP is explicit that providers must not use a third party to apply for a FedRAMP Certification on their behalf. You submit your own forms. That is how Boundera works too: we prepare the complete package, you review it and submit.
- We are pursuing CMMC — does a FedRAMP Marketplace listing help?
- Only if a federal agency will actually use your service, directly or indirectly. The rules state that services used by private companies to meet other compliance requirements such as CMMC, without also meeting a federal use case, are outside the scope of FedRAMP and will not be listed.
- Do we need all sixteen public information items on day one?
- No. The rule requires the items that are available and applicable. Before certification you will not have a FedRAMP ID, and you may not have named an independent assessor yet. Publish what exists, keep it current, and add the rest as it becomes real.
- What happened to FedRAMP Ready and In Process?
- The 2026 model replaces the legacy pre-authorization statuses with the Initial Implementation Phase listing. Existing FedRAMP Ready holders are on a conversion clock, and Ready status is removed entirely at the end of 2027.
Prepare your listing
The listing package, generated from your evidence
The deliverable is concrete: a public information page, a schema-validated machine-readable package overview, a compliant service list, and a Trust Center carrying quarterly progress against documented milestones. That is exactly what our platform generates and hosts — from the same evidence pipeline that runs your compliance program, so your public listing never drifts from reality.
We prepare the complete listing package. You review it and submit the form.
The same Trust Center then carries your quarterly progress updates across the two-year runway, and when you are ready to certify the evidence is already flowing.
Rule references on this page are drawn from the FedRAMP Consolidated Rules for 2026. FedRAMP publishes the authoritative text and its requirements change between releases — confirm the current wording at fedramp.gov before you rely on it.
Ready to Accelerate Your FedRAMP Journey?
Join cloud teams already cutting compliance time by 90%