{"id":"FR2221161553","name":"SecurityScorecard Security Ratings","provider":"SecurityScorecard, LLC","providerSlug":"securityscorecard-llc","status":"FedRAMP Ready","impact":"Moderate","authType":"Agency","serviceModel":["SaaS"],"deployment":"Public Cloud","businessFunctions":["Analytics","Cybersecurity & Risk Management","Data Management","Network Management","Operations Management","System Administration"],"assessor":"Schellman Compliance, LLC","assessorId":"136571","smallBusiness":false,"website":"https://www.securityscorecard.com","description":"SecurityScorecard Security Ratings monitors the security posture of millions of companies by calculating a risk score derived from publicly available data. Companies are assigned A-F ratings across risk factors including domain name system (DNS) health, internet protocol (IP) reputation, web application security, network security, leaked information, hacker chatter, endpoint security, and patching cadence. This data is provided to customers via the Security Ratings web application.\nCustomers use the Security Ratings web application to review security ratings and detailed security reports. Users access Security Ratings through a standard web browser and leverage identity federation for authentication. Within the application, users search for companies of interest and review security reports developed by SecurityScorecard. These ratings and reports allow customers to evaluate the cybersecurity risk for companies of interest using data-driven, objective, and continuously evolving metrics that provide visibility into information security control weaknesses as well as potential vulnerabilities throughout the supply chain ecosystem. Users can also create \"portfolios\" to group together companies of interest and easily compare vendors to help make procurement decisions, evaluate acquisition targets, conduct industry benchmarking, and more.\nAdditional capabilities and data points (collected from publicly available data sources) in the Security Ratings web application include:\n•\tIP attribution to company domain(s)\n•\tSecurity vulnerability monitoring by company and security factors\n•\tSecurity risk benchmarking and scoring by company and industry\n•\tAlerts for changes in risk scores\n•\tExecutive and detailed company scorecard reports\n•\tWorkflow for collaboration and remediation with monitored suppliers\n","logo":"https://www.fedramp.gov/assets/img/logos/CSP_logos/SecurityScorecard%20Logo.png","inMarketplace":true,"agencies":[],"reuseCount":0,"leverages":[],"leveragedBy":[],"timeline":[{"date":"2026-02-17","to":"FedRAMP Ready","certType":"Rev5"}],"cr26":{"type":"Rev5","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no UEI number; include it if you have one","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no business category listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"Schellman Compliance, LLC"},"trustCenterCheck":null}