Who owns a FedRAMP Certification package? FedRAMP says the provider owns the information, and agencies ask the provider

In a May 2026 video, FedRAMP said it owns the certification, but the cloud provider owns the information in the package. Agencies should ask the provider for it, through the provider's trust center, rather than ask FedRAMP.

By FedXchange · May 21, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On May 21, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a short video, "The FedRAMP Certification Package: Who Owns What." The video's description says there is confusion about who owns the information in a certification package. A FedRAMP speaker answers that question.

In short:

What FedRAMP said. FedRAMP owns the certification. The information in the certification package belongs to whoever created it, which is usually the cloud service provider.
Who it affects. Agencies that want to use a FedRAMP Certified cloud service, and the providers that hold those certifications.
What they should do. FedRAMP tells agencies to ask the provider for its package, through the provider's trust center, instead of asking FedRAMP. Providers decide how to share their own information.
By when. The video sets no deadline. FedRAMP's Consolidated Rules for 2026 say cloud service providers are moving to FedRAMP-compatible trust centers by August 2027.

Where an agency gets a certification package

Source: The FedRAMP Certification Package: Who Owns What (FedRAMP video, May 21, 2026).

Read the steps as text

The old way. FedRAMP acted as a clearinghouse, and agencies got packages through FedRAMP.
The way now. The agency goes to the cloud service provider and gets its security information through the provider's trust center.
The goal. The information is shared by machine and loaded into the agency's governance, risk, and compliance tools.

Who owns the information in a certification package?

The speaker opens the video with the answer. In the speaker's words from the video: "So FedRAMP owns the certification, but the information in the certification package is owned by whoever created it."

The speaker explains that a cloud service provider writes down how it runs its service, metrics about it, and vulnerabilities it found. The provider does not produce that information on behalf of the government. It produces it on its own behalf to do business with the government. The speaker says, "Cloud service providers own their data and can do whatever they want with it." That includes sharing the package or posting it publicly. The speaker strongly recommends doing that responsibly and says that posting sensitive secrets publicly is not responsible.

The speaker names one exception. Information a private company produces belongs to that company unless it has a contract with the government that gives ownership to the government. The speaker says providers do not do that unless they are under contract to build a platform for the government.

The speaker also says the speaker's lawyers required them to share this advice: talk to your own lawyer to understand what information you are truly owed.

FedRAMP's Consolidated Rules for 2026 make the same point. The Certification Data Sharing rules say the information "usually remains the provider's intellectual property and is not federal information." FedRAMP's page on accessing certification packages says, "Commercial security information belongs to the company that produces it."

Is a certification package federal information?

No, according to the speaker. The speaker says FedRAMP hears that some companies want to use a large cloud provider but are told they cannot see its secure configuration guide or certification package because it is "federal information." The speaker answers, "No, it is not."

The speaker says the Joint Authorization Board (JAB) coined a term, "federal metadata," and that the government supposedly claimed ownership of that information. The speaker says that was never how things work.

The speaker also says FedRAMP's own program office was not the best example. For a long time, FedRAMP's templates carried Controlled Unclassified Information (CUI) markings in their headers and footers. The speaker says FedRAMP removed those markings the year before the video and is "correcting our mistake."

How should an agency get a provider's package?

The speaker says FedRAMP's role has changed. When FedRAMP started, it acted as a clearinghouse for agencies to get packages. Now FedRAMP tells agencies to go straight to the cloud service provider and get its security information through its trust center. The speaker says FedRAMP is "taking ourselves out as the middleman," which should make the process more efficient.

The speaker says FedRAMP's policies set how this sharing works but leave it deliberately open. The speaker describes a problem raised at an agency liaison meeting that day: today, packages are shared by dragging files into folders in a browser window. One example was a user with 100 cloud service providers. In the speaker's words, "every month they have to download 100 folders and manually parse it. That's untenable." The speaker says the information must be shared by machine and loaded into governance, risk, and compliance (GRC) tools.

The Consolidated Rules for 2026 set requirements for this sharing:

A trust center is "a secure repository or service used by cloud service providers to store and share FedRAMP Certification Data," and trust centers are "the complete and definitive source" for that data (FedRAMP Definitions, FRD-TRC).
Trust centers must give documented programmatic access to all FedRAMP Certification Data (rule CDS-TRC-PAC). They must also keep an inventory and history of agency users or systems with access (CDS-TRC-AAI) and log access (CDS-TRC-ACL).
Cloud service providers are moving to FedRAMP-compatible trust centers by August 2027 (Accessing FedRAMP Certification Packages).
A provider may deny an access request if it does not want to do business with an agency. The provider must tell FedRAMP.

The Office of Management and Budget (OMB) called for this kind of automation in memo M-24-15, "Modernizing the Federal Risk and Authorization Management Program," on July 25, 2024. It says automating the intake and processing of machine-readable security documentation will reduce the burden on program participants.

What does this mean for agencies and providers?

Agency staff should ask the provider first for a package. Check the provider's listing on the FedRAMP Marketplace for its trust center or the contact for requesting access. If the package is still in USDA Connect, the listing links to a request form that the agency's authorizing official must sign. Do not treat a provider's package as federal information unless a contract says it is.

For cloud service providers, the package is yours to share. FedRAMP asks that you share it responsibly. Under the 2026 rules, you are expected to move to a FedRAMP-compatible trust center by August 2027. Its data must be available to programs as well as to people.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.