{"id":"FR1923743650A","name":"WordPress VIP","provider":"Automattic, Inc.","providerSlug":"automattic-inc","status":"FedRAMP Authorized","impact":"Moderate","authType":"Agency","authDate":"2025-03-12","serviceModel":["SaaS"],"deployment":"Public Cloud","businessFunctions":["Analytics","Content Management System (CMS)","Design & Multimedia","Media"],"assessor":"Fortreum, LLC","assessorId":"201664","smallBusiness":false,"website":"https://wpvip.com/","description":"Built on WordPress, the Content Management System (CMS) that powers 43% of the web, WordPress VIP provides a secure, compliant platform for management for government entities. \n\nWith industry-leading security protocols, expert support, flexible architectures, plus 99.99% SLA, hourly backups, and reliable uptime, WordPress VIP takes the heavy lifting out of digitizing citizen services and modernizing legacy infrastructure. \n\nWordPress VIP is built on top of WordPress, an intuitive, easy-to-use CMS that many government employees already know.  By adopting WordPress VIP, IT and technical staff can reduce the amount of support and training required to support their agency.\n\nBut maintaining WordPress and ensuring the security of a WordPress setup can be challenging, and many solutions built on WordPress do not meet the exacting requirements of federal agencies.  Security is WordPress VIP's chief priority. Our data security best practices include end-to-end encryption from edge to origin, resource and data isolation, and encrypted offsite backups. We address physical security through an independently owned and operated network of industry-certified global data centers. Every origin server meets the International Organization of Standardization (ISO), International Electrotechnical Commission (IEC) 27001 certification, Standards for Attestation Engagements (SSAE) No. 18 (SOC1) and SOC2 Type 2, and includes ongoing surveillance reviews. At the application level, every instance is protected with Single Sign-On, SSL/HTTPS/HSTS, required 2FA, and logging and auditing at the application, web server, load balancing, database, and operating system layers. WordPress VIP also fully manages updates and version and responds to any potential security issues immediately, easing the burden of ongoing security and maintenance and lowering total cost of ownership.\n\nWhile our stringent security protocols protect sensitive information, our intuitive and easy-to-use content management workflows make it easy to provide citizens with up-to-date, accessible, and accurate information. Even those with little technical knowledge can successfully navigate WordPress VIP's editing interface with minimal training.","logo":"https://www.fedramp.gov/assets/img/logos/CSP_logos/WP%20Logo.png","inMarketplace":true,"agencies":["22-007-25","22-005","22-036","22-091","22-030","22-055-01","22-026"],"reuseCount":6,"leverages":["AGENCYAMAZONEW","FR1812058188","F1206081364","F1607057910","FR1823447014","FR1821856903"],"leveragedBy":[],"timeline":[{"date":"2023-11-09","to":"Agency Authorization In Process","certType":"Rev5"},{"date":"2023-12-05","to":"FedRAMP In Process","certType":"Rev5"},{"date":"2025-03-12","to":"FedRAMP Certified","certType":"Rev5"}],"cr26":{"type":"Rev5","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no UEI number; include it if you have one","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no business category listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"Fortreum, LLC"},"sponsor":"22-036","trustCenterCheck":null}