FedRAMP ID FR2700754082 · 20x Class C · Program path
Initial Implementation Phase: listed in the FedRAMP Marketplace on 2026-10-08 (FedRAMP ID FR2700754082) for FedRAMP 20x Class C (Moderate), Program path. Independent assessment by DataLock Consulting Group runs 2026-11-16 to 2026-12-04; certification application planned 2027-02-01. Not yet certified.
FedRAMP Marketplace listing: https://fedramp.gov/marketplace/products/FR2700754082
ComplianceONE is a multi-tenant governance, risk and compliance (GRC) platform that federal agencies, their contractors and commercial organizations use to manage FedRAMP, NIST SP 800-53, NIST SP 800-171/CMMC, GovRAMP, DoD Impact Level, TX-RAMP, ITAR and AS9100 programs. It holds control implementation records, policies, procedures, evidence files, POA&Ms, risks, incidents and assessment results; generates certification documents; reads security posture from customer-authorized integrations; and offers AI drafting assistance whose output a person reviews.
Certification data
| Cloud service provider | PlatformOne Group Inc (UEI DR83PCJ11966) |
|---|---|
| Cloud service offering | ComplianceONE (C1) |
| FedRAMP Marketplace | Initial Implementation Phase, FedRAMP ID FR2700754082 (listing) |
| Certification sought | FedRAMP 20x Class C, Program Certification path |
| Service model and deployment | SaaS · Public Cloud |
| Security categorization | Confidentiality moderate, integrity moderate, availability moderate |
| Independent assessor | DataLock Consulting Group (FedRAMP assessor ID 200883) |
| Next Ongoing Certification Report | Three months after certification (first full quarter) |
| Next Quarterly Review | After the first Ongoing Certification Report |
| Certification Package Overview | cpo.json (FedRAMP schema 2026-06-24) |
What is public and what needs agency access
Everything on this page and the JSON files below are public. The full Certification Package (the Security Decision Record, every policy and procedure with its index, Ongoing Certification Reports and their snapshots, monthly vulnerability reports and incident reports) is shared with U.S. federal agencies and FedRAMP through the ComplianceONE Trust Center. See how to request it: email security@platformoneinc.com from an official address, decided within 1 business day, no NDA required.
Services in scope
12 services are in the scope of the certification. Full list with descriptions.
- Frameworks and controls
- Policies and procedures
- Evidence
- POA&M and risk
- Assessments and reports
- Integrations (read-only)
- Trust Center
- Monitoring: incidents, vulnerabilities and CVE Hunter
- AI drafting assistant (CORA)
- Marketing website (complianceone.ai pages outside /trust) (not in scope)
- Help center (not in scope)
- Billing and subscriptions (not in scope)
Certification progress
FedRAMP 20x Class C (Moderate), Program Certification path. Updated 2026-10-08; next update due 2027-01-08. Source: milestones.json.
| # | Milestone | Target | Status |
|---|---|---|---|
| 1 | Public certification data live (fedramp.json, services.json, changes.json, milestones.json, cpo.json, Secure Configuration Guide, Trust Center page) | 2026-10-07 | Done 2026-10-07 |
| 2 | Listed in the FedRAMP Marketplace (Initial Implementation Phase) | 2026-10-08 | Done 2026-10-08: FedRAMP ID FR2700754082 |
| 17 | Independent assessment scheduled within 2 years of listing | 2028-10-08 | Met: DataLock fieldwork scheduled for 2026-11-16 |
| 3 | FedRAMP Recognized assessor selected and engaged | 2026-10-03 | Done: DataLock Consulting Group (assessor ID 200883); engagement signed |
| 4 | Production in Azure Government (US Gov Virginia) | 2026-10-07 | Done 2026-10-07 |
| 5 | KSI metric history starts accruing | 2026-10-07 | In progress since 2026-10-07 |
| 6 | Independent assessment fieldwork (DataLock Consulting Group, all Class C KSIs and FedRAMP rules) | 2026-11-16 to 2026-12-04 | Scheduled |
| 7 | Draft assessment findings | 2026-12-04 | Planned |
| 8 | Corrections to draft findings complete | 2026-12-31 | Planned |
| 9 | First quarterly progress update in the Trust Center, then every quarter | 2027-01-08 | Planned |
| 10 | Independent assessment completed (final assessment report) | 2027-01-15 | Planned |
| 11 | Fresh package verified (automated methods re-run, validator clean) | 2027-01-25 | Planned |
| 12 | Certification Application Form submitted by PlatformOne | 2027-02-01 | Planned |
| 13 | Azure provider in the ComplianceONE KSI registry | 2027-03-15 | Planned |
| 14 | Six months of KSI history complete | 2027-04-07 | Planned |
| 15 | First Ongoing Certification Report and Quarterly Review | Three months after certification | Planned |
| 16 | First annual independent assessment | By 2027-11-16 | Planned |
Machine-readable files
- /trust/cpo.json: Certification Package Overview (FRC-CSO-PKG)
- /trust/fedramp.json: Public certification data (CDS-CSO-PUB)
- /trust/services.json: Service list (CDS-CSO-SVC)
- /trust/changes.json: Significant change history (SCN-CSO-HIS)
- /trust/milestones.json: Certification progress (MKT-IIP-DCP)
- /trust/status.json: Service status (CDS-CSO-AVR)
- /trust/secure-configuration-guide.json: Secure Configuration Guide (SCG-CSO-RSC)
- /.well-known/security.txt: security.txt (RFC 9116)
Formats, caching and the token-based agency endpoints are documented at programmatic access.
Contacts
- Package: Jaskaran Singh Kandola, Co-Founder, Chief Information Officer and Information System Security Officer · jkandola@platformoneinc.com · 703-347-1223
- Security: PlatformOne Security · security@platformoneinc.com · 703-347-1223
- Sales: PlatformOne Solutions · solutions@platformoneinc.com · 703-239-4854
Security vulnerabilities: see the vulnerability disclosure policy and security.txt.
Trust Center · Services · Changes · Status · Secure Configuration Guide · Programmatic access · Security