Skip to main content
Official source: Marketplace Listing (MKT), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.

​
In short

Every cloud service provider needs a FedRAMP Marketplace listing in the Initial Implementation Phase before it can apply for FedRAMP Certification. To get one, you publish required public information, request the listing through the official form (not email), and show your offering is meant for direct or indirect agency use. Once listed, you must publish progress at least quarterly and schedule a Class B, C or D assessment within 2 years, or FedRAMP removes the listing. Assessors and advisors have their own, shorter listing rules.

​
Who it applies to

Upstream says all cloud service providers must get an Initial Implementation Phase listing before they can apply for FedRAMP Certification. FRC-APP-MLF makes this a MUST (see FedRAMP certification).

​
Key dates

The ruleset has one “Effective Date(s)” block for both 20x and Rev5: There’s no grace period beyond 2026-07-04. The same dates appear in the 20x and Rev5 deadline tables.

​
What you need to do

​
FedRAMP responsibilities (MKT-FRP)

This rule binds FedRAMP, not you, but it decides whether your offering can be listed at all.

​
General provider responsibilities (MKT-CSO)

​
Initial Implementation Phase listings (MKT-IIP)

For providers actively preparing for FedRAMP Certification.
The upstream notes on MKT-IIP-AGU say FedRAMP won’t list products outside its statutory scope. Services that private companies use only to meet other compliance requirements, such as CMMC, are out of scope unless they also meet a direct or indirect agency use case. The note on MKT-IIP-DCP says to treat progress reporting as “a marketing and customer experience challenge instead of a compliance challenge.”

​
Assessor responsibilities (MKT-IAS)

For independent assessment services that want a listing.

​
Advisor responsibilities (MKT-CAS)

For consulting and advisory services that want a listing.
Corrective actions for MKT-CAS-RFR. If an advisor misses the 5-business-day window, FedRAMP sends a follow-up. If the advisor misses that too, FedRAMP removes the listing. A removed advisor can’t be listed again for at least 6 months unless there are extenuating circumstances.

​
What FedRAMP staff have said

Staff answers explain how FedRAMP applies the rules. They don’t change the published text, which governs.
What an Initial Implementation listing needs. You don’t need a full FedRAMP-compatible Trust Center to be listed. MKT-CSO-MLR brings in CDS-CSO-PUB, so the available public information must be shared in human-readable and JSON formats, though much of it won’t yet be “available” or “applicable” at this stage. MKT-CSO-PML requires the form. MKT-IIP-AGU, MKT-IIP-DCP and MKT-IIP-DLA must be available in some fashion. A public FedRAMP landing page with all of that information counts as “a basic FedRAMP-compatible Trust Center” (pete-gov, 2026-09-02, discussion #147).
Showing agency use (MKT-IIP-AGU). The evidence is about what your product is designed to do, not what agencies say. It comes from your business as an attestation, not from an agency, so “Don’t make false claims!” For indirect use, the simplest proof is to show which FedRAMP Certified offerings use your product. Commercial and government customers can use the same offering. You must provide this when you request the listing (pete-gov, 2026-10-13, discussion #178). In the same answer, staff called bundling several applications into one boundary to stretch a single use case against the principles of the minimum assessment scope, while noting that isn’t an explicit rule.
Features versus separate offerings. A standalone product with its own team, assurance support and Certification Package is a separate cloud service offering with its own listing. A feature or capability without a standalone package, continuous monitoring or sales pipeline is part of the parent offering and is listed as a service within the parent listing. All FedRAMP requirements must be met to keep a listing (pete-gov, 2026-09-09, discussion #147).
Listing data must be web-readable. Strict web interoperability (CORS and a correct content type) applies to the public JSON needed for a Marketplace listing: “if your Marketplace data isn’t compatible with basic web interoperability standards then we can’t use it” (pete-gov, 2026-09-17, discussion #175). This is now written into FRC-CSO-JSN.
FedRAMP Ready and Initial Implementation. Legacy Ready status expires 365 days after it’s granted by default. For offerings that apply for the limited Ready (RAR) conversion, FedRAMP decides with the provider whether to switch to Initial Implementation after kick-off or at day 366. Once the package is submitted, the offering moves to FedRAMP In Process status (paulagosta, 2026-08-12, discussion #159).