FedRAMP Marketplace shows third-party resources for cloud assessments

FedRAMP announced a November 2, 2026 Marketplace update that replaces the Dependent Products tab with Third-Party Resources. The tab identifies third-party information resources within an offering’s minimum assessment scope, separates FedRAMP Certified and non-FedRAMP Certified resources, and shows how each is used.

For ISSO, RMF and security assessment teams supporting federal cloud acquisitions, the practical benefit is clearer dependency information to examine alongside the security package. The tab can help focus questions about boundary assumptions, data flows and shared responsibilities; a listing alone does not establish that a service meets an agency’s requirements.

Where MAS-CSO-IIR applies, MAS-CSO-TPR requires providers to document relevant third-party usage, configuration, justification, mitigation measures and compensating controls in place. Those obligations are not newly created by the November display update. The current Minimum Assessment Scope rules distinguish 20x initial certification applicability from Rev5 and ongoing-certification transition dates, with an assessment-based grace provision; teams should check the rules for their specific path and class.

FedRAMP’s agency guide advises reviewing security documentation and current certification status before agreements are finalized. FedRAMP certification supports an agency’s own Authorization to Operate decision; it is not an agency ATO. This update is not a solicitation, contract award or endorsement of any provider.