About the data | FedRAMP Trust Center Index

This index is rebuilt every day from three public files FedRAMP publishes on GitHub in marketplace-fedramp-gov-data:

Marketplace data (offerings, agencies, assessors, ATOs), last changed Nov 2, 2026.
CR26 package overviews, the machine-readable public data each provider must publish, exported Nov 2, 2026.
Status changelog, every certification status change, exported Nov 2, 2026.

How the numbers are made

Schema checks and gaps use the open-source tc validator against FedRAMP's official JSON schemas. Gaps are optional fields CR26 expects when available; they are not failures.
Trust center checks request each listed trust center URL about every 6 hours. A sign-in page counts as answering; we only check that the link works. Some sites' firewalls refuse automated requests; we show those as “blocks automated checks”, which is not a judgment of the trust center. Providers who want their site checked can allow the user agent fedramp-trust-center-index (reachability check). A site is marked not answering only after 3 failed checks in a row.
Time to authorization runs from an offering's first in-process status to its first certified status in the changelog. Older dates were migrated by FedRAMP and may be approximate.
CR26 readiness counts authorized offerings whose CR26 package links a trust center. Since Oct 16, 2026, FedRAMP's export includes a package record for most Rev5 offerings, many with the trust center and other CR26 fields left empty, so a record alone doesn't show an offering is ready.
Built on comes from the leveraged systems FedRAMP lists for each offering.
A few changelog rows have shifted columns in the source export; we skip rows without a valid date.

The index is independent and not affiliated with FedRAMP or GSA. Always confirm status on marketplace.fedramp.gov.