FedRAMP Marketplace Authorization Monitor

Monitor official FedRAMP Marketplace product authorization and status data for vendor-risk, procurement, and compliance drift.

This Actor reads the public JSON data maintained by FedRAMP and returns decision-ready rows for Cloud Service Offerings (CSOs): current public status, impact level, authorization path, annual assessment values, reuse counts, status timeline signals, and changes versus a previous snapshot.

What it is good for

• Vendor-risk teams watching whether a cloud service moved from Ready/In Process to Authorized/Certified, or the reverse.
• Public-sector procurement teams monitoring specific CSPs and CSOs on an approved-products watchlist.
• GRC teams that want a scheduled FedRAMP Marketplace delta feed, not a one-off manual search.
• Partner or reseller teams watching high-impact or high-reuse products for procurement timing signals.

Data source

The Actor uses official public FedRAMP Marketplace JSON files from FedRAMP/marketplace-fedramp-gov-data:

• data.json as the current Marketplace product source.
• fedramp-status-changelog.json for status timelines.

FedRAMP removed the obsolete fedramp-products.json export because it was unused by the live Marketplace. The Actor no longer depends on that retired file. The changelog is optional enrichment: if it is temporarily unavailable, current Marketplace rows still run successfully and clearly report that timeline enrichment was unavailable.

The repository README says certification data is uploaded daily between 2-3 AM ET and the Marketplace status changelog between 3-4 AM ET. The Actor records source export timestamps in OUTPUT.

Input

• searchTerms — vendor/product/category/agency terms to match. Empty means use the newest/recently changed Marketplace products up to maxProducts.
• productIds — exact FedRAMP IDs to include, such as FR2000863987A.
• statuses, impactLevels, serviceModels — optional filters.
• changedSince or recentChangeWindowDays — flags recent status updates.
• assessmentDueWindowDays — flags annual assessments due soon or overdue.
• previousSnapshot — optional prior rows from this Actor. Inline JSON comparison avoids requiring private Apify dataset access in this MVP.
• includeAllRows — false returns only alert rows.
• maxProducts — keeps scheduled runs cheap and reviewable.

Output fields

Each dataset row includes:

• FedRAMP product ID, CSP, CSO, official Marketplace URL.
• Public/internal status, impact level, service/deployment/auth fields.
• Authorization date, status update date, and the source's annual assessment value. An ISO assessment date and days-to-due are emitted only when the official source supplies an unambiguous full date.
• Reuse and authorization counts.
• Matched watch terms and latest status-timeline entry.
• Delta fields versus previousSnapshot.
• Alert flag, alert reasons, priority, recommendation, and versioned stable row hash. Hash-only differences are ignored across hash versions so a source-migration hash change alone does not create a drift alert.

Repeat-use loop

Run it on a schedule with the same watch terms/product IDs. Save the previous dataset rows or selected row hashes and pass them back as previousSnapshot on the next run to detect drift. Even without a previous snapshot, the Actor flags recent Marketplace status changes and unambiguous assessment dates inside the configured windows.

Pricing

from $2.00 / 1,000 FedRAMP authorization product rows

This Actor uses Apify Pay per Event pricing with platform usage included. The row event is charged only for useful rows written to the default dataset.

Event	Price	Unit
Actor start (apify-actor-start)	$0.00005	Once when the run starts.
FedRAMP authorization product row (apify-default-dataset-item)	$0.002	Per FedRAMP authorization product row.

A row is one FedRAMP Marketplace cloud service offering / authorization status row. Apify plan discounts, user-configured max-charge limits, and any future Apify pricing UI changes may affect final charges.

Limitations and responsible use

• Unofficial tool; not affiliated with, endorsed by, or sponsored by FedRAMP, GSA, or any listed vendor.
• Uses official public Marketplace data, but users should verify critical procurement/compliance decisions against FedRAMP.gov and the relevant agency/vendor records.
• Does not output vendor contact emails by default and is not positioned as a lead-generation list.
• No browser rendering, proxying, login, or paid API is used.
• FedRAMP may publish an annual assessment as MM/DD without a year. The Actor preserves that value in annualAssessmentRaw but does not guess a year or calculate a due date from an ambiguous value.
• previousSnapshot uses inline JSON so API users and scheduled runs can compare against selected prior rows without granting additional Apify storage permissions.

Related Actors in this portfolio

This Actor is part of the Cloud platform drift monitors group. These are narrow, source-specific Apify Actors intended for scheduled checks and repeatable dataset exports — not broad scraped-content feeds.

• FedRAMP Marketplace Authorization Monitor — FedRAMP Marketplace authorization/status monitoring for vendor-risk workflows.
• AWS IAM Service Authorization Drift Monitor — AWS IAM Service Authorization Reference drift checks for cloud-security reviews.
• CloudFormation Resource Spec Drift Monitor — CloudFormation resource-spec drift checks for replacement-risk and required-property changes.

Each listing includes its own source notes, limits, pricing, and responsible-use caveats. Use the official source links in each Actor when decisions require verification.