The FedRAMP Marketplace, Explained: What Every Listing Status Actually Means

Key takeaways

• The marketplace is the fact source. Every claim of FedRAMP status resolves against it: certified cloud services, their agency authorizations, the accredited assessors, and the recognized advisors.
• The status labels are mid-transition. The listings still say "FedRAMP Authorized"; the 2026 rules call the program's determination a certification, and the agency's own permission to use your service remains a separate authorization (ATO).
• FedRAMP Ready is retired as a path. In July 2026 the program moved Ready to a "Legacy FedRAMP Ready" designation; a recent Readiness Assessment Report is now Class A entry evidence instead.
• The registry tells you the listing, not the firm. No pricing, no client reviews, no staffing, no sector fit. The assessors' A2LA accreditation IDs and dates are checkable facts; everything a buyer compares on beyond that lives elsewhere.
• The counts, from the registry itself (October 24, 2026 snapshot): 533 authorized products across 461 providers, 63 Ready, 12 In Process, 48 Agency In Process, 49 accredited assessors, 15 recognized advisors.

What the marketplace is

The program describes its marketplace as the searchable database of FedRAMP certified cloud services, authorizing agencies, and recognized assessors. Two things make it more useful than most government registries:

1. It is published as data, not just as pages. The registry lives in a public repository, produced by GSA and refreshed daily, with a documented JSON schema and separate files for assessors and advisors. Anything you read about a listing, including our own directory, should cite a snapshot date.
2. The assessor listings carry checkable accreditation facts. Each independent assessor's A2LA accreditation ID and original accreditation date are in the record. "We are a 3PAO" resolves to a registry row, an ID, and a date.

The listing statuses, and what each one means

FedRAMP Authorized (533 products as of the October 2026 snapshot). The product has completed the program's assessment and certification requirements and holds agency authorizations. Under the 2026 rules the program's determination is called a FedRAMP Certification, and the marketplace labels still read "Authorized" during the transition. Each authorized listing also carries a count: how many agencies have authorized the product for their own use, the closest thing the registry has to an adoption signal.

Legacy FedRAMP Ready (63 listings). Ready retired in July 2026 as a road to certification and moved to a legacy designation on the marketplace. Two things survive it: recent Readiness Assessment Reports remain viable as Class A entry evidence, and the designation on the marketplace tells you the firm had completed an assessment against the old baselines.

FedRAMP In Process (12 listings). The provider is actively working toward certification with the program's review pipeline. It is a statement of intent and progress, not a status a buyer can rely on for anything yet.

Agency In Process (48 listings). An agency is working the product through its own authorization path. Closer to use than "In Process," still not a certification.

The certification classes ride alongside. Under the 2026 rules each listing maps to a class, A through D, the progressive ladder replacing the old Low/Moderate/High labels. The class tells you how much assurance the listing carries; the status tells you where in the pipeline it sits. (The classes, and what each obligates.)

What the registry cannot tell you

• What any of it costs. No pricing exists anywhere in the record.
• Whether past clients were satisfied. No reviews, no references, no outcomes.
• Whether the firm knows your sector or your platform.
• Who would actually staff your engagement.
• For assessors and advisors: anything beyond the listing fact itself. The program's own Finding an Advisor page says advisory listings are published without formal quality review and do not represent endorsement. (What to ask instead.)

That gap is the design: a registry lists facts. Our documented FedRAMP directory exists to sit next to the registry with the listing facts attached and the gaps named, so a buyer sees both what is proven and what is unknown.

How to actually use it

1. Verify claims against it. A vendor says they are FedRAMP authorized: find the listing, read the class and the impact level, count the agency authorizations, check the snapshot date.
2. Check the assessors' A2LA IDs. The accreditation ID and date are the registry's strongest per-firm facts.
3. Read status with the transition in mind. "Authorized" listings are operating under the 2026 rules' timeline: initial and ongoing certification require the consolidated rules from January 1, 2027, and new Rev5 certifications end June 11, 2027.
4. Then compare on the things the registry does not hold. Services, sector experience, staffing, and price, which is what the directory and a structured RFP are for.

Frequently asked questions

Is ChatGPT FedRAMP authorized? Yes, per the registry: OpenAI's ChatGPT Enterprise and API Platform is FedRAMP Authorized at 20x Moderate with 3 agency authorizations (October 2026 snapshot), and Google's Gemini for Government is Authorized at 20x Low. Both are documented as product profiles with their registry facts. Anthropic has no FedRAMP marketplace listing as of the same snapshot.

What is the difference between Authorized and Certified? The 2026 rules renamed the program's determination a certification; the marketplace's status labels still read "Authorized" during the transition. The agency's permission to use the service (the ATO) is separate and always the agency's own.

Is FedRAMP Ready still a thing? As a path to certification, no: it retired in July 2026 and became a legacy designation. A recent Readiness Assessment Report is now Class A entry evidence.

What does In Process mean for a buyer? Not yet usable as evidence of anything. The provider is in the pipeline; the listing becomes meaningful at certification.

How current is the marketplace? The underlying data refreshes daily (the government publishes it as JSON with a timestamp); any statement about a listing should carry a snapshot date, including this one.

New to the whole program? Start with the 2026 path, class by class.