In This Article
Learn what you need to know about the CPO from Isaac Teuscher
A Certification Package Overview (CPO) is required for FedRAMP 20x and Legacy FedRAMP under CR26. It’s a publicly available, machine-readable JSON file that gives agencies a high-level overview of your cloud service offering. Every provider going through FedRAMP certification, or holding one, has to produce it.
It carries the essentials, including your service description, logo, sales and security contacts, UEI number, and FedRAMP ID, so agencies and buyers can find and understand your offering without asking you for a document.
I built and published Paramify's own CPO, so I’ll walk you though what the CPO is and what is required in it, how to read the JSON schema, how to validate your file with FedRAMP's schema validator, and how we published ours on the Paramify Trust Center.
Why Does the CPO Matter?
The CPO matters for structural and practical reasons.
Structurally:
The CPO is part of what replaced the narrative System Security Plan under the FedRAMP Consolidated Rules for 2026. CR26 splits the old SSP into two documents: the Certification Package Overview, a concise structured summary of your offering, and the Security Decision Record, a maintained record of your security decisions mapped to FedRAMP rules and KSIs.
If you have spent years maintaining a Word document that weighs several pounds, the CPO is your first look at what comes next.
Practically
The CPO is the front door. The FedRAMP Marketplace has always been the public page where agencies look up a cloud service offering. The CPO extends that into the machine-readable world: instead of a human reading a webpage, an agency's tooling pulls one JSON file and gets the same high-level picture, tied to your FedRAMP ID.
The full requirements live in the package rulesets within the FedRAMP consolidated rules for 2026 at fedramp.gov. Open the package ruleset for the Certification Package Overview and you get every requirement plus a link to the related JSON schema.
For providers pursuing 20x Class A, the CPO ruleset is one of three that apply, alongside FedRAMP Certification and Marketplace Listing; our step-by-step guide to getting a FedRAMP 20x Class A certification covers how those fit together.
For the wider CR26 picture and deadlines, see every FedRAMP 20x deadline you need to know.
What is Required in a Certification Package Overview?
The CPO mirrors what appears on your FedRAMP Marketplace listing. If you have filled out a Marketplace listing, you already know most of these values. The CPO is where they live as structured data.
Two of these deserve a note. Your UEI number comes from your registration at SAM.gov; it is not something FedRAMP assigns. And the logo field is not an uploaded image: the schema expects a URL pointing to your logo file, with a pattern match that verifies the format.
How Do You Read the FedRAMP JSON Schema?
Every machine-readable FedRAMP deliverable has a JSON schema published at fedramp.gov/schemas. Your CPO must conform to that schema to count as a valid deliverable.
When you first load the schema it looks like gibberish. Read past that and the structure is plain: a schema version at the top, then field definitions with descriptions, required flags, and format patterns.
The key concept is that this is a minimal specification:
- You must include every field the schema marks as required: service name, service acronym, website, logo, service description, and the other core values.
- You may add fields on top. Say you maintain three logos: a square mark, a wide horizontal lockup, and a full-page landscape version. You can include all three as additional fields, as long as one of them satisfies the required logo value.
For the pedantic among us (a compliment in this line of work): extra fields do not invalidate the file. Our published CPO carries ten additional fields beyond the required set, and it validates clean.
How Do You Validate Your CPO File?
FedRAMP publishes a validator at fedramp.gov/schemas/validator. The process takes about a minute:
- Open the validator and select the machine-readable file you are validating against, in this case Certification Package Overview. The page notes it is a minimal specification, same as above.
- Paste your JSON into the JSON document section.
- Run the validation.
A passing result confirms your document conforms to the FedRAMP Certification Package Overview schema, and the validator lists any additional fields it found beyond the required set.
A failing result tells you which field broke and why: a missing required value, a format mismatch on something like the logo URL pattern, or malformed JSON.
Validate before you publish, every time the file changes. The point of machine-readable deliverables is that conformance is checkable in seconds, so there is no excuse for publishing a file that does not conform.
Where Does the CPO Have to Be Published?
Publicly. Like the FedRAMP Marketplace listing it mirrors, the CPO is meant to be available to anyone: an agency evaluating your service, FedRAMP itself, or a customer doing diligence.
Under CR26, a trust center is also the required channel for sharing certification data with agencies, which makes it the natural home for the file.
Here is how I published ours. In the Paramify Trust Center, under our FedRAMP 20x program, I uploaded the CPO as a deliverable for our Class C certification, set availability to publicly available, saved the deliverables, then confirmed and published. Class C is the CR26 designation for what used to be called Moderate, and Paramify took it through an early pilot as the first GRC tool to do so.
That may be the first time a CPO has been publicly hosted on a FedRAMP certified trust center, which is a strange thing to be excited about, and I was excited about it anyway.
You can see the result at trust.paramify.com: go to our deliverables, hit "see all," and scroll down to the Paramify Certification Package Overview. Any agency or customer can pull that machine-readable file and get the high-level picture of the Paramify Cloud service offering without asking us for access.
→New to trust centers? Start here: Why You need a FedRAMP 20x trust center for FedRAMP 20x.
Who Needs a Certification Package Overview?
Any cloud service provider that is:
- Going through the FedRAMP 20x certification
- Already FedRAMP certified and maintaining a Marketplace listing under CR26 rules
If you are still deciding on your path, the CPO is a useful preview of the model: small, structured, schema-validated deliverables instead of monolithic documents. The rest of the package works the same way. See what a digital ATO package looks like and why FedRAMP authorization is now certification for how deep that shift goes.
How Does Paramify Help With Machine-Readable Deliverables?
The honest answer to "how hard is this one file?" is: not very, if you know your values and read the schema.
The grind is that the CPO is one of roughly a dozen machine-readable deliverables 20x and CR26 can ask for. They all have schemas, the schemas carry version numbers that change, and every one of them has to stay in sync with what your program actually looks like.
Paramify is a risk management platform that supports all types of FedRAMP including FedRAMP 20x. We generate these machine-readable files for customers, the CPO included, from the data already in your workspace. Your service details live in one place; the deliverables are outputs, not documents someone hand-edits at 11 p.m. before a submission.
The Paramify Trust Center then hosts them at the public availability CR26 requires. That is the process I described above, run on Paramify Cloud itself, and it is what the Paramify FedRAMP 20x solution does for customers.
Build Your CPO and SDR
The CPO is new to us all. The JSON schema page looks like gibberish on first load. It is not. It is a floor of required fields, a validator that checks your work in seconds, and a public URL where the file lives.
That is the Certification Package Overview in full: your Marketplace listing as structured data, validated against FedRAMP's own schema, published where any agency can pull it. It is also a fair preview of what CR26 asks for across the board, small checkable machine-readable artifacts in place of documents nobody wanted to write.
We generate those deliverables in Paramify from our existing program data and host them on our trust center at the public availability CR26 requires. That is how the CPO in this article got published, and it is what the platform does for customers.
Next steps:
- See a live example on the Paramify Trust Center
- Read the step-by-step guide to FedRAMP 20x Class A certification, where the CPO is one of three rulesets that apply
- Check your dates against every FedRAMP 20x deadline you need to know
- See how Paramify supports FedRAMP 20x, or explore the Trust Center product
FAQ
What is a Certification Package Overview in FedRAMP? A required CR26 deliverable that provides a publicly available, high-level overview of a cloud service offering in machine-readable JSON and human-readable form: service description, contacts, UEI, FedRAMP ID, and related identifying details.
Does the CPO replace the SSP? Under CR26, the narrative System Security Plan is replaced by two documents: the Certification Package Overview and the Security Decision Record. The CPO is the structured summary of your offering; the SDR carries your security decisions mapped to FedRAMP rules and KSIs.
Is the Certification Package Overview public? Yes. It is meant to be publicly available, the same way a FedRAMP Marketplace listing is. Hosting it on a public trust center satisfies that.
What format does the CPO use? Machine-readable JSON conforming to the schema published at fedramp.gov/schemas, alongside a human-readable version.
Where do I find the official schema? At fedramp.gov/schemas. The package ruleset for the Certification Package Overview in the FedRAMP consolidated rules for 2026 links to the related JSON schema.
Can I add extra fields to my CPO? Yes. The schema is a minimal specification. Required fields must be present and conforming; additional fields on top are allowed.
How do I know if my file is valid? Paste it into the FedRAMP validator at fedramp.gov/schemas/validator, select Certification Package Overview as the file you are validating against, and run it. It reports conformance and lists any extra fields.
What is a UEI number and where does it come from? The Unique Entity ID, issued through your registration at SAM.gov. It identifies your organization to the federal government and is one of the values in your CPO.
Does my logo go in the file? As a URL, not an embedded image. The schema expects a link to your logo file and pattern-matches the format.
What happens if the schema version changes? Schemas carry version numbers and get updated. Check fedramp.gov/schemas for the current version and re-validate your file whenever it changes.
Who owns this file inside a CSP? The compliance or GRC team owns the content, and the values come from the same sources as your Marketplace listing. Once the data lives in a system rather than a document, regenerating the file after a change is a non-event.
Where can I see a real published CPO? On the Paramify Trust Center at trust.paramify.com, under deliverables.
Can Paramify generate this file for us? Yes. Paramify generates FedRAMP machine-readable files, including the Certification Package Overview, for customers.
.svg)
.svg)
