Is it FRME?

How this works

What the rule asks for

DFARS 252.204-7012 governs cloud services that hold a defense contractor's covered defense information. The DoD CIO memo of 21 December 2023 summarizes it: the contractor must require and ensure that the provider meets security requirements equivalent to the FedRAMP Moderate baseline. The memo describes two ways to get there:

  1. FedRAMP Moderate Authorized. The memo does not apply to CSOs that are FedRAMP Moderate Authorized; those services can be leveraged without further assessment.
  2. FedRAMP Moderate equivalent. The service must achieve 100 percent compliance with the latest FedRAMP moderate security control baseline through an assessment conducted by a FedRAMP-recognized Third Party Assessment Organization (3PAO) and present the following supporting documentation to the contractor as the body of evidence (BoE): the System Security Plan, Security Assessment Plan, Security Assessment Report and Plan of Action and Milestones. The memo adds that it does not allow for POA&M's resulting from a 3PAO assessment, and that the onus is on the contractor to validate the BoE.

Why Rev5 and 20x are shown apart

FedRAMP now labels listings by type (Rev5 or 20x) and class (A to D). Its notice NTC-0004 maps the Rev5 classes onto the old baselines: Class C will include the current Moderate baseline, and Class D will include the current High baseline. For 20x it says the requirements will align with Rev5 Classes, so a 20x Class C listing is meant to sit at the Moderate level. But DoD has not yet said that a 20x certification satisfies DFARS 252.204-7012 or CMMC. Until it does, only a Rev5 Class C or D listing gets the green check here, and a 20x listing is flagged.

Why some authorized services are listed and others are not

This site tracks equivalency claims. A service that once marketed itself as FRME and is now Rev5 authorized stays listed, in its own section, because its old announcements still circulate; the entry shows the authorization and links the old claim. A service that only ever claimed an authorization is left off: GSA's Marketplace already answers for it.

Services with no FRME claim

Some services come up often in questions but make no claim of FedRAMP Moderate equivalency. When one does, it is listed in its own section with the date we searched and, where there is one, a link to the vendor's own security or compliance page, so you can read what it does claim. We search again every 30 days, and a service that starts claiming FRME moves to the main list.

What each entry shows, and what it leaves out

An entry means the claim is recorded accurately. It is not a finding that a service is, or is not, equivalent; that judgment belongs to the contractor, with the body of evidence in hand.

What this site is not

Not an authoritative list, registry or marketplace. Nothing here certifies, approves or ranks a cloud service. The official record of FedRAMP authorizations is GSA's FedRAMP Marketplace, and no government body keeps a list of equivalent services. This site is not affiliated with GSA, FedRAMP or the Department of Defense.

Neutral and impartial. We aim to record every claim the same way, in the vendor's own words, linked to where it was made, and to describe each Marketplace listing from GSA's own data. We take no payment of any kind, from vendors or anyone else, to list, remove or rank a service. If a vendor thinks an entry is wrong or out of date, it can tell us, and the entry is corrected once the public source shows it.

No warranty. Everything here is provided as is, without warranty of any kind. Vendor pages and Marketplace listings change; check the linked source, and the body of evidence, before relying on any entry. Nothing here is legal or compliance advice, and the decision to use a cloud service for CUI belongs to the contractor.

A free resource, not a service. This site is free, and it is not a service anyone can count on: it may change, go stale or go offline at any time, without notice.

License

The text of this site and the compilation in data.json are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). Reuse them freely, including commercially, as long as you credit isitfr.me with a link and say whether you changed anything. A copy can go stale, so please link back to the live entry.

Two things are not ours to license. Vendor quotations belong to the vendors; they are quoted so readers can see exactly what was claimed, and reusing them is between you and the vendor. GSA's FedRAMP Marketplace data is a work of the United States government and is in the public domain.

Raw data: data.json, the same published fields as this site.