Section 8.4 - Register entry
DOC-REF: FRC-MKT-FR2206159758
Constellation GovCloud (CGC)
Merlin International lists Constellation GovCloud (CGC) on the FedRAMP Marketplace with the status FedRAMP Certified, at Moderate impact, on the JAB path under the Rev5 process. Package FR2206159758, read from the marketplace feed as of September 3, 2026.
Section A. Register entry
What the marketplace records
- FedRAMP package ID
- FR2206159758
- Cloud service provider
- Merlin International
- Certification status
- FedRAMP Certified
- Impact level
- Moderate
- Certification class
- Class C (Moderate)
- Authorization path
- JAB
- Certification type
- Rev5
- Marketplace phase
- Ongoing Certification
- Deployment model
- Public Cloud
- Register snapshot
- September 3, 2026
- Service model
- PaaS
- Independent assessor
- Fortreum, LLC
- Certification date
- February 17, 2026
- Status date
- February 17, 2026
- FedRAMP Ready date
- April 25, 2022
- Annual assessment
- November 24, 2011
- Agency authorizations
- 1
- Business categories
- Governance, Risk, and Compliance (GRC)
- Small business
- Flagged on the marketplace record
- Milestones on record
- 3
The marketplace carries Constellation GovCloud (CGC) under package FR2206159758 with 20 recorded fields. Its certification date is February 17, 2026, and a FedRAMP Ready date of April 25, 2022. Fortreum, LLC is named as the independent assessor, with an annual assessment date of November 24, 2011. 1 agency is listed as having authorized it, among them Cybersecurity & Infrastructure Security Agency. It is delivered as PaaS on a public cloud, filed under 1 business categories including Governance, Risk, and Compliance (GRC). Merlin International is flagged as a small business on the record.
Section B. Milestones
3 entries in the marketplace event log
Most recent first, as recorded by FedRAMP.
| Date | Category | Recorded |
|---|---|---|
| February 17, 2026 | Status Change | Status changed from JAB Review to FedRAMP Certified |
| April 25, 2023 | Status Change | Status changed from FedRAMP Ready to FedRAMP In Process |
| April 25, 2022 | Status Change | Status set to Legacy FedRAMP Ready |
Section C. Cost context
What reaching Moderate costs
Our own published ranges for a provider going through this level. Nothing here is a figure this provider has disclosed.
Cost context
Budget for a Moderate authorization
Our published planning range for a provider pursuing Moderate. It is not a figure any listed provider has disclosed.
Read the FedRAMP Moderate cost guide / annual assessment cost / continuous monitoring cost
Path
The marketplace lists 53 offerings against the JAB path. Our JAB vs Agency page records that the JAB P-ATO path was retired in 2024 and that Agency Authorization is now the single traditional route, at $800,000 to $2,000,000 over 12 to 18 months. JAB vs Agency ATO cost
Assessment and monitoring
An annual assessment date of November 24, 2011 is on the record, and that assessment recurs for as long as the package stays listed. Annual assessment cost / continuous monitoring cost
Section E. Agencies on the record
1 agency listed against this package
As published on the marketplace. An agency named here has issued its own authorization to operate; FedRAMP does not issue ATOs itself.
- Cybersecurity & Infrastructure Security Agency
Section G. Nearest entries on the register
Comparable offerings
Scored on impact level, path, status, shared business categories and how close the two entries sit in the register's own timeline.
- Verkada Command Platform
Verkada Inc
FedRAMP Certified, Moderate impact, Agency path, Rev5, certified May 12, 2026.
- Gordian Federal Cloud powered by RSMeans Data
Gordian
FedRAMP Certified, Moderate impact, JAB path, Rev5, certified July 2, 2022.
- Apptio for Technology Business Management and Cloud Financial Management (TBM)
Apptio an IBM company
FedRAMP Certified, Moderate impact, JAB path, Rev5, certified April 5, 2018.
- SAP NS2 Cloud Intelligent Enterprise
SAP National Security Services Inc. (SAP NS2)
FedRAMP Certified, Moderate impact, JAB path, Rev5, certified November 13, 2017.
- Smartsheet Gov
Smartsheet
FedRAMP Certified, Moderate impact, JAB path, Rev5, certified August 12, 2019.
Section H. Description
As published on the marketplace
The provider's own description of the service, reproduced from the FedRAMP feed without edits.
Constellation GovCloud (CGC) is an information system that provides the necessary Platform as a Service (PaaS) architecture layers to support Merlin-operated Software as a Service (SaaS) applications. These Merlin SaaS applications will be hosted and provided to U.S. federal agencies, including local and state governments and tribal organizations. The CGC is part of a managed service that is designed to accelerate FedRAMP authorizations allowing Merlin SaaS companies to achieve a FedRAMP Authority to Operate (ATO) more quickly and cost-effectively. Cynamics, a leading innovator in network cybersecurity, presents a next-generation SOC AI platform powered by its proprietary sample-based NDR and cybersecurity large language model, CynLLM. By integrating intelligent sampling with cutting-edge AI, Cynamics facilitates real-time and scalable threat detection without the heavy infrastructure requirements of traditional solutions. Already endorsed by Tier-1 municipalities, enterprises, and critical infrastructure providers globally, Cynamics offers unparalleled visibility, automation, and operational efficiency for today's security teams. InfoSec Global Federal's AgileSec Analytics provides automated discovery, monitoring, and policy‑driven control of cryptographic assets, including keys, certificates, algorithms, libraries, devices, applications, firmware, and protocols, across cloud and on‑premise environments. The AgileSec Analytics platform ensures agencies are prepared for emerging cryptographic threats, including quantum attacks, by monitoring usage of cryptography and preparing migration to post-quantum cryptography. Key capabilities include Automated Cryptographic Discovery & Inventory, Vulnerability Identification and Compliance Reporting, Post-Quantum Readiness, and Continuous Monitoring and Remediation Workflows. The AgileSec Analytics solution supports regulatory requirements including OMB 23-02 mandates and continuous diagnostics, with built-in reporting features evaluated and recognized by federal standards organizations. It also integrates with numerous ecosystem technologies including EDR, CLM, PKI, HSM, CDM dashboards, ITSM, GRC tools and more. Hyperproof delivers a modern, cloud-based compliance operations platform designed to help government agencies and regulated organizations manage risk and compliance with confidence. Hyperproof Gov is a cloud-based governance, risk, and compliance (GRC) platform designed to support regulated organizations in managing security and compliance programs. The system provides centralized capabilities for control management, evidence collection, risk tracking, audit support, and continuous monitoring. Hyperproof Gov enables structured workflows and real-time compliance status reporting to support authorization, assessment, and ongoing monitoring activities. The platform is designed to integrate with external systems for automated evidence collection and to maintain traceability between controls, requirements, and supporting artifacts, supporting consistent and repeatable compliance operations.
Next step
What the same authorization would cost you
The worksheet turns an impact level, an existing security posture and an organization size into a line-by-line budget, with the 3PAO fee split out.
Provenance and independence
Source: the FedRAMP Marketplace product feed, produced by the General Services Administration. The feed's own last-change stamp is September 3, 2026; this copy was taken on September 5, 2026.
GSA's disclaimers page states that FedRAMP content about a specific commercial product or service is provided for the information and convenience of the public and “does not constitute endorsement, recommendation, or favoring by the General Services Administration”. A listing here is a record of a certification status, not a judgment about the product.
FedRAMPCost.com is an independent cost reference. We are not affiliated with FedRAMP, the GSA, any provider listed on this page, or any assessment organization, and no provider pays to appear in this register.