Define the actual agency use

Start with the mission, information and users involved. The agency determines whether its use case falls within FedRAMP scope. A broad product name cannot answer that question on its own.

  • Identify the exact offering, edition and features you plan to use.
  • Describe identity connections, integrations and the information exchanged.
  • Record which work belongs to the provider and which work remains with the agency.

Read what the evidence actually covers

Review the offering’s current Marketplace profile and the relevant 20x or Rev5 package. Look for scope, assumptions, configuration guidance, exclusions and the responsibilities the customer must perform. Agency use guidance supports reusing provider assurance without confusing it with the agency’s own system decision.

Make the next action explicit

Selections stay on this page only and are not saved.

This is a due-diligence aid. Follow your agency’s applicable authorization, procurement and risk-management process.

Official sources

These sources support the guidance above. Verify current requirements with the official program before making a compliance decision.

  1. FedRAMP scope and applicabilityFedRAMP, U.S. General Services Administration · Access checked 2026-11-04
  2. Using FedRAMP as a federal agencyFedRAMP, U.S. General Services Administration · Access checked 2026-11-04
  3. Understanding certification classesFedRAMP, U.S. General Services Administration · Access checked 2026-11-04
  4. Using a 20x certification packageFedRAMP, U.S. General Services Administration · Access checked 2026-11-04
  5. Using a Rev5 certification packageFedRAMP, U.S. General Services Administration · Access checked 2026-11-04
  6. Official FedRAMP MarketplaceFedRAMP, U.S. General Services Administration · Access checked 2026-11-04