2026/reference/marketplace-listing/

[giscus[bot]]

2026/reference/marketplace-listing/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/reference/marketplace-listing/

[tnnrjmsn-eit]

Typo in MKT-CSO-PML:

- Providers MUST notify FedRAMP using the FedRAMP Marketplace Providing Listing Request Form to request a listing in the FedRAMP Marketplace.
+ Providers MUST notify FedRAMP using the FedRAMP Marketplace Provider Listing Request Form to request a listing in the FedRAMP Marketplace.

[pete-gov]

Typo in MKT-CSO-PML:

Thank you, I feel like I need to do an agentic pass to be like "are there any obvious mistakes in wording here that aren't typos or grammatical errors" to maybe catch others like this. Won't be 100% but might catch anything else this obvious! Appreciate it.

I have created FedRAMP/rules#48 to address this.

[xadams]

MKT-CSO-MLR states that CDS-CSO-PUB is required for any Marketplace listing or update, but CDS-CSO-PUB itself indicates that it is only for Class B, C, and D. Can you help me understand what public data a CSP applying for Initial Implementation or Class A needs to include? Thanks!

[xadams]

Furthermore, SCG-CSO-RSC (Secure Configuration Guide) is included in CDS-CSO-PUB but is itself listed as required for Class B, C, and D. This item can represent a significant amount of effort so I'm interested in when it becomes a requirement.

[pete-gov]

It's a bit confusing at first the way we apply "exception" rules - Class A and Initial Implementation are "exceptions" that can pull specific rules out of a ruleset subset that doesn't apply to them. I am working on a different approach to this to publish in December because that approach isn't as straightforward as we thought.

To apply for Initial Implementation you need to meet the General Provider Responsibilities and Provider Responsibilities for Initial Implementation Phase Listings under Marketplace Listing. That includes CDS-CSO-PUB, though a lot of that information won't be "available" or "applicable" yet. That data is what feeds are our Marketplace so it's quite important though.

To apply for Class A, you need to address the Marketplace Listing General Provider Responsibilities & have an Initial Implementation Phase Listing, then you need to address the FedRAMP Certification General Provider Responsibilities, FedRAMP Class A Certification Rules, and Applying for FedRAMP Certification subsets.

When one of those rules pulls in another rule (saying you need to address a rule such as AFC-CSO-INB) then that rule applies even though the full subset it's in doesn't apply to Class A by default.

Furthermore, SCG-CSO-RSC (Secure Configuration Guide) is included in CDS-CSO-PUB but is itself listed as required for Class B, C, and D. This item can represent a significant amount of effort so I'm interested in when it becomes a requirement.

The secure configuration guide rules aren't required by any of the Class A rules, so you'd just mark this "not applicable" or "not available" in your public overview data.

Apologies for the confusion on this, plan is to clear up stuff around Class A by next month.