Constellation GovCloud (CGC)

FedRAMP package ID

FR2206159758

Cloud service provider

Merlin International

Certification status

FedRAMP Certified

Impact level

Moderate

Certification class

Class C (Moderate)

Authorization path

JAB

Certification type

Rev5

Marketplace phase

Ongoing Certification

Deployment model

Public Cloud

Register snapshot

September 28, 2026

Service model

PaaS

Certification date

February 17, 2026

Status date

February 17, 2026

FedRAMP Ready date

April 25, 2022

Annual assessment

November 24, 2011

Agency authorizations

1

Business categories

Governance, Risk, and Compliance (GRC)

Milestones on record

3

The marketplace carries Constellation GovCloud (CGC) under package FR2206159758 with 18 recorded fields. Its certification date is February 17, 2026, and a FedRAMP Ready date of April 25, 2022. No independent assessor is named on the record. 1 agency is listed as having authorized it, among them Cybersecurity & Infrastructure Security Agency. It is delivered as PaaS on a public cloud, filed under 1 business categories including Governance, Risk, and Compliance (GRC).

• Cynamics AI

  Available from February 17, 2026

  Cynamics, a leading innovator in network cybersecurity, presents a next-generation SOC AI platform powered by its proprietary sample-based NDR and cybersecurity large language model, CynLLM. By integrating intelligent sampling with cutting-edge AI, Cynamics facilitates real-time and scalable threat detection without the heavy infrastructure requirements of traditional solutions. Already endorsed by Tier-1 municipalities, enterprises, and critical infrastructure providers globally, Cynamics offers unparalleled visibility, automation, and operational efficiency for today's security teams.

• Hyperproof Gov

  Available from February 17, 2026

  Hyperproof delivers a modern, cloud-based compliance operations platform designed to help government agencies and regulated organizations manage risk and compliance with confidence. Hyperproof Gov is a cloud-based governance, risk, and compliance (GRC) platform designed to support regulated organizations in managing security and compliance programs. The system provides centralized capabilities for control management, evidence collection, risk tracking, audit support, and continuous monitoring. Hyperproof Gov enables structured workflows and real-time compliance status reporting to support authorization, assessment, and ongoing monitoring activities. The platform is designed to integrate with external systems for automated evidence collection and to maintain traceability between controls, requirements, and supporting artifacts, supporting consistent and repeatable compliance operations.

• InfoSec Global Federal - AgileSec Analytics

  Available from February 17, 2026

  InfoSec Global Federal's AgileSec Analytics provides automated discovery, monitoring, and policy-driven control of cryptographic assets, including keys, certificates, algorithms, libraries, devices, applications, firmware, and protocols, across cloud and on-premise environments. The AgileSec Analytics platform ensures agencies are prepared for emerging cryptographic threats, including quantum attacks, by monitoring usage of cryptography and preparing migration to post-quantum cryptography. Key capabilities include Automated Cryptographic Discovery & Inventory, Vulnerability Identification and Compliance Reporting, Post-Quantum Readiness, and Continuous Monitoring and Remediation Workflows. The AgileSec Analytics solution supports regulatory requirements including OMB 23-02 mandates and continuous diagnostics, with built-in reporting features evaluated and recognized by federal standards organizations. It also integrates with numerous ecosystem technologies including EDR, CLM, PKI, HSM, CDM dashboards, ITSM, GRC tools and more.

• InfraLink

  M.C. Dean, Inc.

  FedRAMP Certified, Moderate impact, JAB path, Rev5, certified November 24, 2023.

• Collabspace

  Collabware

  FedRAMP Certified, Moderate impact, JAB path, Rev5, certified July 28, 2023.

• Zoom for Government

  Zoom Video Communications, LLC

  FedRAMP Certified, Moderate impact, JAB path, Rev5, certified July 28, 2023.

• Open Federal Logistics Information System (OpenFLIS)

  Synergetics Incorporated

  FedRAMP Certified, Moderate impact, JAB path, Rev5, certified October 13, 2022.

• Verkada Command Platform

  Verkada Inc

  FedRAMP Certified, Moderate impact, Agency path, Rev5, certified May 12, 2026.

Constellation GovCloud (CGC) is an information system that provides the necessary Platform as a Service (PaaS) architecture layers to support Merlin-operated Software as a Service (SaaS) applications. These Merlin SaaS applications will be hosted and provided to U.S. federal agencies, including local and state governments and tribal organizations. The CGC is part of a managed service that is designed to accelerate FedRAMP authorizations allowing Merlin SaaS companies to achieve a FedRAMP Authority to Operate (ATO) more quickly and cost-effectively. **Services undergoing approval for use - not authorized.** The following services are hosted on CGC but are **not** authorized services and are **not** included in this certification. They are undergoing approval for use and are recorded here for transparency only; neither is covered by this package, and each moves into the certified service list only on completion of that approval. - **Torq AI SOC Platform** - Torq combines agentic insights and automation so that federal agencies and public sector organizations can triage, investigate, and respond to actual risks, faster. Torq streamlines every step from alert through resolution, expanding capacity and throughput. First, Torq ingests and normalizes telemetry from across your security stack, preparing the data for agentic reasoning at scale. Auto Triage filters out noise and prioritizes actual threats. Next, cases are automatically opened and assigned to highly specialized AI agents designed for investigation and response. Using tools and actions you specify, they gather evidence, assemble timelines, and transparently record decisions and authorized actions. Your team is in complete control. With Torq, your SOC delivers more results, more efficiently, from triage through remediation. - **QIZ** - QIZ delivers a cloud-based cryptography posture management platform for government agencies and regulated organizations to manage cryptographic risk. The system provides centralized capabilities for cryptographic discovery and inventory, correlation of findings to affected systems and owners, policy definition, risk-based triage, root cause analysis, and remediation planning. QIZ collects cryptographic data from network traffic, system and application configurations, source code, binaries, and cloud infrastructure. Cryptographic standards are defined within the platform, and the system evaluates the environment against those standards to report current posture and identify policy violations. QIZ produces a contextualized cryptographic bill of materials (CBOM), exportable in standard formats, and a policy driven transition plan prioritized by risk and business context, giving agencies a sequenced and repeatable path toward post-quantum readiness.