Scope: For independent assessment services seeking a FedRAMP Marketplace listing or updates to an existing listing following CR26 JSON guidelines.
User Expectations:
- Independent assessment services are expected to first be A2LA accredited to qualify for FedRAMP Recognition on the Marketplace.
- Once accredited, independent assessment services MUST submit their Marketplace information in human-readable and JSON formats in alignment with the MKT-IAS-WEB rule.
- Assessors can validate their JSON using the Assessor Schema Validator.
- Independent assessment services MUST report information relating to any foreign interest, foreign influence, or foreign control (FOCI) of the independent assessment service to FedRAMP annually, or within 48 hours of any change in foreign ownership or control, using the IAS FOCI Declaration Form.
- If an independent assessment service has already provided FedRAMP with their human-readable and JSON content, any updates to this content MUST be made directly using the existing JSON URL by the independent assessment service.
- Independent assessment services MUST NOT submit a new form to request manual content changes.
- If the URL does change, the independent assessment service must provide the new URL to FedRAMP.
Estimated Timeline:
- FedRAMP Review: 3-5 business days
- Marketplace Publication: 3-5 business days after approval
