FedRAMP Marketplace shows third-party resources for cloud assessments
A November 2 Marketplace update separates certified and non-certified third-party resources, helping federal security teams examine cloud dependencies.
Source: Cyber Defense Group. Original reporting and dates are preserved.
NOIRLab headquarters server room in Tucson, Arizona. Archival illustrative infrastructure, not a FedRAMP-certified offering or a marketplace participant. Resized for presentation; no endorsement implied.
NOIRLab/NSF/AURA/T. Slovinský · Creative Commons Attribution 4.0 International · LicenseThe photograph above has its own source and credit. Image references in the original reporting below may describe a different image on the source publication.
Cyber Defense Group update
FedRAMP announced a November 2, 2026 Marketplace update that replaces the Dependent Products tab with Third-Party Resources. The tab identifies third-party information resources within an offering’s minimum assessment scope, separates FedRAMP Certified and non-FedRAMP Certified resources, and shows how each is used.
For ISSO, RMF and security assessment teams supporting federal cloud acquisitions, the practical benefit is clearer dependency information to examine alongside the security package. The tab can help focus questions about boundary assumptions, data flows and shared responsibilities; a listing alone does not establish that a service meets an agency’s requirements.
Where MAS-CSO-IIR applies, MAS-CSO-TPR requires providers to document relevant third-party usage, configuration, justification, mitigation measures and compensating controls in place. Those obligations are not newly created by the November display update. The current Minimum Assessment Scope rules distinguish 20x initial certification applicability from Rev5 and ongoing-certification transition dates, with an assessment-based grace provision; teams should check the rules for their specific path and class.
FedRAMP’s agency guide advises reviewing security documentation and current certification status before agreements are finalized. FedRAMP certification supports an agency’s own Authorization to Operate decision; it is not an agency ATO. This update is not a solicitation, contract award or endorsement of any provider.
Sources and references
Source publication notes
This is a Marketplace presentation update, not a new solicitation or a newly introduced assessment obligation.
MAS-CSO-TPR applies only where MAS-CSO-IIR applies; check path, class and transition/grace dates.
FedRAMP certification does not grant an agency Authorization to Operate.
Educational information, not legal advice. Current official program guidance and the instructions for your application control. Registration, certification, or consulting does not guarantee an award.