When a Vendor Says "FedRAMP Compliant"

Step 1: Search the FedRAMP Marketplace. Go to marketplace.fedramp.gov and search for the vendor by name. If an offering appears as FedRAMP Certified ("Authorized" on older listings), note the specific cloud service offering, its certification class (Class B, C or D, shown alongside Low, Moderate or High, or the FedRAMP 20x Class A), the certification path (directly by FedRAMP, or an agency ATO), and the date. In Process, Initial Implementation and Legacy FedRAMP Ready listings are not certifications. If no offering appears, the vendor holds no FedRAMP certification.

Step 2: Check for government-specific products. Some vendors offer separate government editions with FedRAMP authorization while their standard product is not authorized. Slack offers GovSlack with FedRAMP Moderate authorization — standard Slack is not authorized. Zoom offers Zoom for Government. AWS offers GovCloud. Make sure the authorized product is the one you are actually using.

Step 3: Check for equivalent certifications. If the vendor is not FedRAMP authorized, check whether they hold StateRAMP, IL-4/IL-5 provisional authorization, or other government-aligned certifications that may satisfy your specific requirements.

Step 4: Document the finding. Whether the vendor is authorized or not, document the result in your risk register with the verification date and source (FedRAMP Marketplace URL). For vendors not authorized, document the impact on your workloads and any compensating controls.

FedRAMP's Consolidated Rules for 2026 renamed "Authorization" to "Certification" and replaced impact levels with certification classes: Class B for Low, Class C for Moderate, Class D for High. They apply to all stakeholders from 1 January 2027, and existing Rev5 authorizations stay listed through the transition.

Three changes matter when you check a vendor. The path: FedRAMP 20x certifications come directly from FedRAMP, with no agency sponsor; the agency-sponsored path is now a legacy path available only for Rev5. The classes: 20x Class A, B and C are available today and a 20x Class D is not yet, so a High (Class D) listing is a Rev5 certification. The statuses: FedRAMP Ready stopped accepting submissions on 28 July 2026, and a new Initial Implementation listing shows providers early in preparing. Neither is a certification. The full comparison is in FedRAMP 20x vs. Rev5.

If you are on the other side of this, a provider weighing certification for your own service, the free FedRAMP 20x Readiness Explorer gives a starting checklist.

"Vendor says FedRAMP compliant but isn't in the marketplace." "FedRAMP compliant" is not an official designation. It means nothing in terms of federal procurement requirements. Only a certified offering ("FedRAMP Certified" on the Marketplace, or "Authorized" on older listings) satisfies federal compliance. See our detailed guide on FedRAMP authorization status for the full distinction between compliant, ready, and authorized.

"We need FedRAMP but the vendor isn't authorized — can we still use them?" For federal workloads involving CUI or covered data, you must use FedRAMP-authorized services. For non-federal workloads, FedRAMP is a positive signal but not a requirement. If you need the vendor for a federal workload and they are not authorized, document the gap, evaluate alternatives, and if no alternative exists, develop compensating controls and obtain formal risk acceptance from your authorizing official.

"Does FedRAMP authorization cover all the vendor's products?" No. FedRAMP authorization covers specific cloud service offerings (CSOs), not the vendor's entire product line. Salesforce Government Cloud is authorized; standard Salesforce may or may not be. Always verify that the specific product you use is within the authorized scope.

ThirdProof automatically checks the FedRAMP Marketplace for every vendor investigated and includes the result in the compliance assessment section. The check runs as part of the ${ACTIVE_SOURCE_COUNT}-source assessment — no separate lookup required.

ThirdProof's assessment of Dropbox noted 10 compliance certifications on Dropbox's trust page (SOC 2, ISO 27001, HIPAA, PCI DSS, and others) and classified all as vendor-attested. FedRAMP is settled separately, against the Marketplace: Dropbox — not on the FedRAMP Marketplace (as of Oct 27, 2026). For a government contractor evaluating a vendor for CUI workloads, a vendor with no Marketplace listing cannot be used for covered workloads, and alternatives must be evaluated.

Conversely, Slack claims FedRAMP on its trust page. The Marketplace is what settles that claim too: Slack — FedRAMP Certified: GovSlack (Class D (High)), Slack (Class C (Moderate)). The recommended action is the same for any vendor: confirm at marketplace.fedramp.gov which offering is certified, at which class, and whether the product you buy is that offering.

From FedRAMP's own Marketplace data, read live (as of Oct 27, 2026):

AWS — FedRAMP Certified: AWS GovCloud (Class D (High)), AWS US East/West (Class C (Moderate))

Microsoft Azure and Microsoft 365 — FedRAMP Certified: Microsoft 365 Government Community Cloud & Supporting Services (Class C (Moderate)), Microsoft 365 Government Community Cloud-High (Class D (High)), Azure Commercial Cloud (Class D (High)), and 1 more

Salesforce — FedRAMP Certified: Salesforce Government Cloud (Class C (Moderate)), Salesforce Government Cloud Plus (Class D (High))

Okta — FedRAMP Certified: Okta IDaaS Government High Cloud (GHC) (Class D (High)), Okta IDaaS Regulated Cloud (Class C (Moderate))

GitHub — FedRAMP Certified: GitHub Enterprise Cloud (Class B (LI-SaaS))

Zoom — FedRAMP Certified: Zoom for Government (Class C (Moderate))

Snowflake — FedRAMP Certified: The Data Cloud on AWS GovCloud (High) (Class D (High)), The Data Cloud on AWS US East/West (Class C (Moderate)), The Data Cloud on Azure Government (High) (Class D (High))

Datadog — FedRAMP Certified: Datadog for Government (Class D (High))

Box — FedRAMP Certified: Box Enterprise Cloud Content Collaboration Platform (Class D (High))

ServiceNow — FedRAMP Certified: Government Community Cloud (Class D (High))

Splunk — FedRAMP Certified: Splunk Cloud Platform for FedRAMP High (Class D (High)), Splunk Cloud Platform for FedRAMP Moderate (Class C (Moderate))

CrowdStrike — FedRAMP Certified: CrowdStrike Falcon Platform for Government (Class D (High)), CrowdStrike Falcon Platform IL5 SaaS (Class D (High))

Zscaler — FedRAMP Certified: Zscaler Internet Access - Government (Secure Web Gateway - vTIC) (Class C (Moderate)), Zscaler Internet Access - Government (Secure Web Gateway - vTIC) - High (Class D (High)), Zscaler Private Access - Government (Zero Trust Exchange - VPN Replacement) (Class C (Moderate)), and 1 more

Stripe — not on the FedRAMP Marketplace

Dropbox — not on the FedRAMP Marketplace

Notion — not on the FedRAMP Marketplace

HubSpot — not on the FedRAMP Marketplace

Airtable — not on the FedRAMP Marketplace

1Password — not on the FedRAMP Marketplace

Shopify — not on the FedRAMP Marketplace

MongoDB — FedRAMP Certified: MongoDB Atlas for Government (Class C (Moderate))

Vercel — not on the FedRAMP Marketplace

DigitalOcean — not on the FedRAMP Marketplace

Supabase — not on the FedRAMP Marketplace

A vendor not being listed does not mean they are insecure. It means they have not completed FedRAMP certification, a substantial undertaking that usually makes business sense only for vendors with federal customer demand. For non-federal workloads, evaluate these vendors on their other certifications (SOC 2, ISO 27001, PCI DSS) and overall risk posture.

ThirdProof checks FedRAMP authorization status automatically as part of every vendor assessment. Try free.