{"id":"FR2414158717","name":"RegScale CCM","provider":"RegScale","providerSlug":"regscale","status":"FedRAMP Authorized","impact":"High","authType":"Agency","authDate":"2025-06-24","serviceModel":["SaaS"],"deployment":"Public Cloud","businessFunctions":["Collaboration","Cybersecurity & Risk Management","Governance, Risk, and Compliance (GRC)"],"assessor":"A-LIGN Compliance and Security, Inc. dba A-LIGN","assessorId":"138665","smallBusiness":true,"website":"https://www.regscale.com","description":"The RegScale Continuous Controls Monitoring (CCM) Platform is delivered as a Software-as-a-Service (SaaS) offering, hosted in a multi-tenant public cloud computing environment. Built on Microsoft Azure, RegScale provides next-generation Governance, Risk, and Compliance (GRC) capabilities that allow organizations to automate and accelerate the management of cybersecurity programs such as FISMA, FedRAMP, CMMC, PCI, HIPAA, and others.\n\nRegScale helps organizations address their most difficult compliance challenges by enabling customers—via robust API integrations—to manage controls, upload evidence documentation, perform system assessments, and maintain certifications and authorizations. This is all centralized within a single platform, offering a “single pane of glass” experience. Automation ensures that data and compliance posture are updated in near real-time.\n\nRegScale ensures that security and privacy-related controls are properly identified, implemented, and maintained throughout the System Development Lifecycle (SDLC) for systems, applications, services, processes, and related initiatives. The platform enables customers to establish and maintain an information assurance capability, including Control Validation Testing, to verify that appropriate controls are operational and risks are managed prior to production deployment.\n\nWhile RegScale may be designated a major application for many large organizations, it is not typically classified as mission-critical. RegScale is a modern, cloud-native application, designed to scale using Docker containers, which are micro-segmented and orchestrated using Microsoft Azure services. The system is designed to be hosted in any environment, with security-focused runtime configuration through environmental variable injection.\n","logo":"https://www.fedramp.gov/assets/img/logos/CSP_logos/RegScale%20Logo.png","inMarketplace":true,"agencies":["22-011-05","22-007-18","22-002"],"reuseCount":2,"leverages":[],"leveragedBy":["F1303191948"],"timeline":[{"date":"2025-05-23","to":"Agency Authorization In Process","certType":"Rev5"},{"date":"2025-05-27","to":"FedRAMP In Process","certType":"Rev5"},{"date":"2025-06-24","to":"FedRAMP Certified","certType":"Rev5"}],"cr26":{"type":"Rev5","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no business category listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"A-LIGN Compliance and Security, Inc. dba A-LIGN"},"sponsor":"22-002","trustCenterCheck":null}