Skip to content

FedRAMP Marketplace

FedRAMP products for each security function

Every FedRAMP Marketplace listing FedXchange matches to the 18 security functions your documents name. In the app, your agency's own authorizations come first, and you can choose any of these.

From the FedRAMP Marketplace's public data as of October 3, 2026: 533 authorized products, 157 of them matched to a function here. A product matches by its name or by the Marketplace's own tag, and a cloud platform counts where its authorization covers the capability. Being listed here is not an endorsement, and FedXchange is not affiliated with these companies.

Getting a product through CDM? Continuous Diagnostics and Mitigation (CDM) supplies software-, platform-, and infrastructure-as-a-service products that are on this Marketplace. Choose the product from the list, and FedXchange records that it comes through CDM.

Identity and Access Management

Until you choose, your documents say “the identity provider”.

FedRAMP listings (13)

FedRAMP Marketplace listings for Identity and Access Management
ProductCompanyModelImpact levelAgencies authorized
Okta IDaaS Regulated CloudOktaSaaSModerate37
Login.govGeneral Services AdministrationSaaSModerate19
Duo FederalDuo Security (a Cisco Company)SaaSModerate14
BeyondTrust Identity Security For GovernmentBeyondTrustSaaSModerate9
Okta IDaaS Government High Cloud (GHC)OktaSaaSHigh8
ID.me Identity GatewayID.meSaaSModerate7
SailPoint Identity Security CloudSailPoint Technologies, Inc.SaaSModerate6
Keeper ICAM & Identity Security Platform for GovernmentKeeper SecuritySaaSHigh5
Saviynt Enterprise Identity Cloud (EIC)Saviynt, Inc.SaaSModerate5
Idira Endpoint Privilege Manager for GovernmentPalo Alto Networks, Inc.SaaSHigh4
Idira Identity Security Government Services PlatformPalo Alto Networks, Inc.SaaSHigh3
IAM AdvantageUberEtherPaaS, SaaSHigh1
RSA® ID Plus for GovernmentRSA Security LLCSaaSModerate1

Cloud platforms whose authorization covers it (4)

Cloud platforms that cover Identity and Access Management
ProductCompanyModelImpact levelAgencies authorized
Azure Commercial CloudMicrosoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh79
AWS US East/WestAWS security services (IAM, KMS, Backup, Config, Security Hub) run inside the AWS authorizations; check the service is in scope.AmazonIaaS, PaaS, SaaSModerate69
Azure Government (includes Dynamics 365)Microsoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh61
AWS GovCloudAWS security services (IAM, KMS, Backup, Config, Security Hub) run inside the AWS authorizations; check the service is in scope.AmazonIaaS, PaaS, SaaSHigh51

Run by the government

  • USAccess (General Services Administration (GSA))Personal Identity Verification (PIV) credentials and their life cycle, for more than 100 federal agencies
  • Login.gov (General Services Administration (GSA))Sign-in and identity proofing for the public using agency applications

Endpoint Detection and Response

Until you choose, your documents say “the endpoint detection and response (EDR) tool”. Many agencies get this through CDM: choose the product below.

FedRAMP listings (5)

FedRAMP Marketplace listings for Endpoint Detection and Response
ProductCompanyModelImpact levelAgencies authorized
CrowdStrike Falcon Platform for GovernmentCrowdStrike, Inc.SaaSHigh36
SentinelOne Singularity Platform HighSentinelOneSaaSHigh7
Trellix GovCloud Security PlatformTrellixSaaSHigh3
Trend Cloud One for GovernmentTrend Micro Inc.SaaSModerate1
Trend Vision One for GovernmentTrend Micro Inc.SaaSModerate1

Cloud platforms whose authorization covers it (4)

Cloud platforms that cover Endpoint Detection and Response
ProductCompanyModelImpact levelAgencies authorized
Microsoft 365 Government Community Cloud & Supporting ServicesMicrosoft 365 services such as SharePoint, Exchange Online, and Intune run inside the Microsoft 365 authorizations; check the service is in scope.MicrosoftSaaSModerate91
Azure Commercial CloudMicrosoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh79
Azure Government (includes Dynamics 365)Microsoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh61
Microsoft 365 Government Community Cloud-HighMicrosoft 365 services such as SharePoint, Exchange Online, and Intune run inside the Microsoft 365 authorizations; check the service is in scope.MicrosoftSaaSHigh5

Vulnerability Management

Until you choose, your documents say “the vulnerability scanner”. Many agencies get this through CDM: choose the product below.

FedRAMP listings (4)

FedRAMP Marketplace listings for Vulnerability Management
ProductCompanyModelImpact levelAgencies authorized
Tenable Government SolutionsTenable Public Sector (TPS)SaaSModerate20
Qualys Cloud PlatformQualysSaaSModerate17
Qualys Government PlatformQualys, Inc.SaaSHigh2
InsightGovCloudRapid7SaaSModerate1

Run by the government

  • Cyber Hygiene Vulnerability Scanning and Web Application Scanning (CISA)Free external scanning of internet-facing hosts and public web applications, with weekly and monthly reports

SIEM and Log Management

Until you choose, your documents say “the security information and event management (SIEM) system”. Many agencies get this through CDM: choose the product below.

FedRAMP listings (9)

FedRAMP Marketplace listings for SIEM and Log Management
ProductCompanyModelImpact levelAgencies authorized
Splunk Cloud Platform for FedRAMP ModerateSplunkSaaSModerate21
Datadog for GovernmentDatadog, Inc.SaaSHigh13
Dynatrace PlatformDynatraceSaaSModerate9
Elastic CloudElasticSaaSModerate8
Splunk Cloud Platform for FedRAMP HighSplunkSaaSHigh8
New RelicNew RelicSaaSModerate6
Sumo LogicSumo LogicSaaSModerate3
Cribl.Cloud GovernmentCribl Inc.SaaSModerate1
Elastic Cloud Hosted - HighElastic Cloud HostedSaaSHigh1

Cloud platforms whose authorization covers it (2)

Cloud platforms that cover SIEM and Log Management
ProductCompanyModelImpact levelAgencies authorized
Azure Commercial CloudMicrosoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh79
Azure Government (includes Dynamics 365)Microsoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh61

Run by the government

  • Logging Made Easy (CISA)Free, open-source log management for organizations without a SIEM

Mobile Device Management / Endpoint Configuration

Until you choose, your documents say “the mobile device management (MDM) tool”.

FedRAMP listings (3)

FedRAMP Marketplace listings for Mobile Device Management / Endpoint Configuration
ProductCompanyModelImpact levelAgencies authorized
Ivanti Neurons for MDM (Formerly MobileIron)IvantiSaaSModerate4
NinjaOne for GovernmentNinjaOneSaaSModerate2
Omnissa Government ServicesOmnissaSaaSHigh1

Cloud platforms whose authorization covers it (2)

Cloud platforms that cover Mobile Device Management / Endpoint Configuration
ProductCompanyModelImpact levelAgencies authorized
Microsoft 365 Government Community Cloud & Supporting ServicesMicrosoft 365 services such as SharePoint, Exchange Online, and Intune run inside the Microsoft 365 authorizations; check the service is in scope.MicrosoftSaaSModerate91
Microsoft 365 Government Community Cloud-HighMicrosoft 365 services such as SharePoint, Exchange Online, and Intune run inside the Microsoft 365 authorizations; check the service is in scope.MicrosoftSaaSHigh5

Network Security and Web Gateway

Until you choose, your documents say “the secure web gateway”.

FedRAMP listings (14)

Run by the government

  • Protective DNS (CISA)DNS filtering that blocks known or suspected malicious destinations; available to federal civilian executive branch agencies

IT Service Management / Ticketing

Until you choose, your documents say “the ticketing system”.

FedRAMP listings (6)

FedRAMP Marketplace listings for IT Service Management / Ticketing
ProductCompanyModelImpact levelAgencies authorized
Government Community CloudServiceNowPaaS, SaaSHigh90
Atlassian Government CloudAtlassianSaaSModerate11
Zendesk Customer Support and Help Desk PlatformZendeskSaaSLI-SaaS5
BMC HelixBMC Helix, Inc.SaaSModerate4
Ivanti Neurons for ITSM (Formerly Service Manager)IvantiSaaSModerate3
ITMX Platform featuring Service & Asset Management, Universal Discovery, CMDB and Project & Portfolio ManagementOpenTextPaaS, SaaSModerate1

Governance, Risk, and Compliance

Until you choose, your documents say “the GRC system”.

FedRAMP listings (13)

FedRAMP Marketplace listings for Governance, Risk, and Compliance
ProductCompanyModelImpact levelAgencies authorized
Diligent One Platform (D1P)Diligent, Inc.SaaSModerate7
TalaTek intelligent Governance and Risk Integrated Solution (TiGRIS)TalaTek, LLCSaaSModerate4
RegScale CCMRegScaleSaaSHigh3
Xacta SaaSTelos CorporationSaaSHigh2
ComplySyncATOASSYSTSaaS20x Moderate1
Drata Trust Management PlatformDrataSaaS20x Low1
IntelliGRCIntelliGRC, Inc.SaaS20x Low1
ITAMContinuum GRC, Inc.SaaSModerate1
Onspring GovCloudOnspring Technologies, LLCSaaSModerate1
Paramify CloudParamifySaaS20x Moderate1
Vanta Government CloudVantaSaaS20x Moderate1
Vanta Trust Management PlatformVantaSaaS20x Low1
XBU40InfusionPointsPaaS, SaaS20x Moderate1

Cloud platforms whose authorization covers it (1)

Cloud platforms that cover Governance, Risk, and Compliance
ProductCompanyModelImpact levelAgencies authorized
Government Community CloudServiceNow Integrated Risk Management runs inside the ServiceNow Government Community Cloud authorization; check the module is in scope.ServiceNowPaaS, SaaSHigh90

Run by the government

  • JCAM (formerly CSAM) (Department of Justice)Assessment and authorization application with inventory, configuration, and vulnerability management, offered to other agencies

Cloud Infrastructure Platform

Until you choose, your documents say “the cloud platform”.

FedRAMP listings (8)

FedRAMP Marketplace listings for Cloud Infrastructure Platform
ProductCompanyModelImpact levelAgencies authorized
Azure Commercial CloudMicrosoftIaaS, PaaS, SaaSHigh79
AWS US East/WestAmazonIaaS, PaaS, SaaSModerate69
Azure Government (includes Dynamics 365)MicrosoftIaaS, PaaS, SaaSHigh61
AWS GovCloudAmazonIaaS, PaaS, SaaSHigh51
Google Services (Google Cloud Platform Products and underlying Infrastructure)GoogleIaaS, PaaS, SaaSHigh24
CG-TTS - Cloud.Gov18F - 18F Cloud.govPaaSModerate19
Oracle Cloud Infrastructure-Government CloudOracleIaaS, PaaSHigh16
IBM Cloud for GovernmentIBMIaaS, PaaSHigh4

Backup and Recovery

Until you choose, your documents say “the backup service”.

FedRAMP listings (6)

FedRAMP Marketplace listings for Backup and Recovery
ProductCompanyModelImpact levelAgencies authorized
Druva Data Resiliency CloudDruva, Inc.SaaSModerate13
AvePoint Online Services for US Government (AOS-UG)AvePoint Inc.SaaSModerate8
Commvault Cloud for GovernmentCommvault Systems, Inc.SaaSHigh7
Own Government CloudOwnBackupSaaSModerate6
Rubrik Security Cloud - Government (RSC-G)RubrikSaaSModerate4
Cohesity Cloud Services for GovernmentCohesitySaaSModerate1

Cloud platforms whose authorization covers it (4)

Cloud platforms that cover Backup and Recovery
ProductCompanyModelImpact levelAgencies authorized
Azure Commercial CloudMicrosoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh79
AWS US East/WestAWS security services (IAM, KMS, Backup, Config, Security Hub) run inside the AWS authorizations; check the service is in scope.AmazonIaaS, PaaS, SaaSModerate69
Azure Government (includes Dynamics 365)Microsoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh61
AWS GovCloudAWS security services (IAM, KMS, Backup, Config, Security Hub) run inside the AWS authorizations; check the service is in scope.AmazonIaaS, PaaS, SaaSHigh51

Encryption and Key Management

Until you choose, your documents say “the key management service”.

FedRAMP listings (3)

FedRAMP Marketplace listings for Encryption and Key Management
ProductCompanyModelImpact levelAgencies authorized
Keyfactor for GovernmentKeyfactorSaaSModerate1
Vaultara Flare ServicesVaultara, LLCSaaSModerate1
Virtru Data Security PlatformVirtruSaaSModerate1

Cloud platforms whose authorization covers it (4)

Cloud platforms that cover Encryption and Key Management
ProductCompanyModelImpact levelAgencies authorized
Azure Commercial CloudMicrosoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh79
AWS US East/WestAWS security services (IAM, KMS, Backup, Config, Security Hub) run inside the AWS authorizations; check the service is in scope.AmazonIaaS, PaaS, SaaSModerate69
Azure Government (includes Dynamics 365)Microsoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh61
AWS GovCloudAWS security services (IAM, KMS, Backup, Config, Security Hub) run inside the AWS authorizations; check the service is in scope.AmazonIaaS, PaaS, SaaSHigh51

Email and Communication Security

Until you choose, your documents say “the email security gateway”.

FedRAMP listings (8)

FedRAMP Marketplace listings for Email and Communication Security
ProductCompanyModelImpact levelAgencies authorized
Trellix Email Security GovCloudTrellixSaaSModerate6
Proofpoint Email and Information Protection ServiceProofpoint, Inc.SaaSModerate5
Proofpoint Targeted Attack ProtectionProofpoint, Inc.SaaSModerate4
Proofpoint Email ArchiveProofpoint, Inc.SaaSModerate3
Valimail Enforce PlatformValimailSaaSLI-SaaS3
Abnormal AI for GovernmentAbnormal AISaaSModerate1
Cyber AI Mission Defense and Email ProtectionDarktrace Federal Inc.SaaSHigh1
Incydr GovMimecastSaaSModerate1

Cloud platforms whose authorization covers it (3)

Cloud platforms that cover Email and Communication Security
ProductCompanyModelImpact levelAgencies authorized
Microsoft 365 Government Community Cloud & Supporting ServicesMicrosoft 365 services such as SharePoint, Exchange Online, and Intune run inside the Microsoft 365 authorizations; check the service is in scope.MicrosoftSaaSModerate91
Google WorkspaceGmail runs inside the Google Workspace authorization.GoogleSaaSHigh19
Microsoft 365 Government Community Cloud-HighMicrosoft 365 services such as SharePoint, Exchange Online, and Intune run inside the Microsoft 365 authorizations; check the service is in scope.MicrosoftSaaSHigh5

Asset Management and Discovery

Until you choose, your documents say “the asset inventory tool”. Many agencies get this through CDM: choose the product below.

FedRAMP listings (7)

FedRAMP Marketplace listings for Asset Management and Discovery
ProductCompanyModelImpact levelAgencies authorized
Armis FedRAMP Edition (AFE)Armis Federal LLCSaaSModerate11
Tanium Cloud for US Government (TC-USG)TaniumSaaSModerate5
Axonius Asset CloudAxonius Federal SystemsSaaSModerate4
Asset Management Suite (AMS)Bridge Intelligence LLC. dba AssetIntelSaaSModerate1
Forescout for GovernmentForescout Technologies, Inc.SaaSHigh1
ITMX Platform featuring Service & Asset Management, Universal Discovery, CMDB and Project & Portfolio ManagementOpenTextPaaS, SaaSModerate1
Sunflower Asset Management Cloud (SAMC)CGI FederalSaaSModerate1

Cloud platforms whose authorization covers it (1)

Cloud platforms that cover Asset Management and Discovery
ProductCompanyModelImpact levelAgencies authorized
Government Community CloudServiceNow Discovery and the CMDB run inside the ServiceNow Government Community Cloud authorization; check the module is in scope.ServiceNowPaaS, SaaSHigh90

Security Awareness Training

Until you choose, your documents say “the security awareness platform”.

FedRAMP listings (2)

FedRAMP Marketplace listings for Security Awareness Training
ProductCompanyModelImpact levelAgencies authorized
KnowBe4 PlatformKnowBe4, Inc.SaaSModerate22
Cofense PhishMeCofenseSaaSModerate8

Continuous Monitoring and Posture Management

Until you choose, your documents say “the cloud security posture tool”. Many agencies get this through CDM: choose the product below.

FedRAMP listings (4)

FedRAMP Marketplace listings for Continuous Monitoring and Posture Management
ProductCompanyModelImpact levelAgencies authorized
Wiz for U.S. GovernmentWiz, Inc.SaaSHigh7
Aqua Platform for GovernmentAqua Security Software Inc.SaaSHigh1
Orca Cloud Security PlatformOrca SecuritySaaSModerate1
Tenable Cloud Security for US Government - ErmeticTenableSaaSModerate1

Cloud platforms whose authorization covers it (4)

Cloud platforms that cover Continuous Monitoring and Posture Management
ProductCompanyModelImpact levelAgencies authorized
Azure Commercial CloudMicrosoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh79
AWS US East/WestAWS security services (IAM, KMS, Backup, Config, Security Hub) run inside the AWS authorizations; check the service is in scope.AmazonIaaS, PaaS, SaaSModerate69
Azure Government (includes Dynamics 365)Microsoft security services (Entra ID, Defender, Sentinel, Key Vault) run inside the Azure authorizations; check the service is in scope.MicrosoftIaaS, PaaS, SaaSHigh61
AWS GovCloudAWS security services (IAM, KMS, Backup, Config, Security Hub) run inside the AWS authorizations; check the service is in scope.AmazonIaaS, PaaS, SaaSHigh51

Run by the government

  • ScubaGear (Secure Cloud Business Applications) (CISA)Free tool that checks a Microsoft 365 tenant (Entra ID, Exchange Online, SharePoint, Teams, and others) against CISA's secure configuration baselines

Document Management / Policy Library

Until you choose, your documents say “the document library”.

FedRAMP listings (7)

FedRAMP Marketplace listings for Document Management / Policy Library
ProductCompanyModelImpact levelAgencies authorized
Microsoft 365 Government Community Cloud & Supporting ServicesMicrosoftSaaSModerate91
Box Enterprise Cloud Content Collaboration PlatformBox Inc.PaaS, SaaSHigh50
Google WorkspaceGoogleSaaSHigh19
Kiteworks Federal CloudKiteworks USA, LLCSaaSModerate16
Microsoft 365 Government Community Cloud-HighMicrosoftSaaSHigh5
NetDocuments Document Management System (DMS)NetDocuments Software, Inc.SaaSModerate5
OpenText Cloud for GovernmentOpenTextPaaS, SaaSModerate2

Vulnerability Disclosure Platform

Until you choose, your documents say “the vulnerability disclosure platform”.

FedRAMP listings (3)

FedRAMP Marketplace listings for Vulnerability Disclosure Platform
ProductCompanyModelImpact levelAgencies authorized
On-Demand Security Testing PlatformSynackSaaSModerate4
HackerOne Continuous Security Testing PlatformHackerOneSaaSLI-SaaS3
Bugcrowd for Government (BCGOV)Bugcrowd Inc.SaaSModerate1

Run by the government

  • Vulnerability Disclosure Policy Platform (CISA)Report intake, triage, and researcher communication for agency vulnerability disclosure programs; more than 50 civilian agencies take part

Learning Management System

Until you choose, your documents say “the learning management system (LMS)”.

FedRAMP listings (13)

FedRAMP Marketplace listings for Learning Management System
ProductCompanyModelImpact levelAgencies authorized
Cornerstone GalaxyCornerstone OnDemandSaaSModerate22
PowerTrain Government Learning Enclave - SaaSPowerTrain Inc.SaaSModerate16
PercipioSkillsoftSaaSModerate12
Blackboard LMSBlackboardSaaSModerate9
Knox SystemsCoSo Cloud, LLC.SaaSModerate6
Private CloudSkillsoftSaaSModerate4
Totara Talent Development Government Cloud PlatformTotara Learning Inc.SaaSModerate4
Adobe Learning ManagerAdobeSaaSLI-SaaS2
Aztec Learning SystemAztec SoftwareSaaSModerate1
Docebo Learning Platform for Gov (DCBO-GOV)DoceboSaaSModerate1
Federal Immersive Learning Management System (FED-ILMS)Creative Veteran ProductionsSaaSModerate1
Meridian LMSMeridian Knowledge Solutions, LLCSaaS20x Moderate1
TRAIN Learning NetworkPublic Health FoundationSaaSLow1

Run by the government

  • FedTalent (Department of the Interior, Interior Business Center)Talent management system combining learning management and performance management