Package 2026.10.6Machine-readable CPO

Public certification overview

Trust, engineered.

The Armory is stackArmor's FedRAMP Class D (High) Rev. 5 platform for building, operating, and continuously monitoring mission-ready workloads on Google Cloud.

Explore certification FedRAMP Marketplace Armory product page
FedRAMP packageFR2513256853
Impact baselineFedRAMP Class D (High) Rev. 5
CertificationRev5 · Agency
Next OCROct 15, 2026
01 / Overview

A secure foundation for regulated cloud missions.

The Armory is a purpose-built General Support System (GSS) cloud service offering (CSO) that delivers security and compliance services aligned to the FedRAMP Class D (High) Rev. 5 risk categorization baseline. The Armory accelerates the ability for Independent Software Vendors (ISVs) and Enterprises to meet complex regulatory requirements on the Google Cloud Platform (GCP). The Armory delivers and continuously monitors FedRAMP compliant, risk-mitigated cloud solutions to government agencies and their partners through either a hosted or managed delivery model by:

  • providing full compliance architecture, engineering, documentation and audit support,
  • reducing the burden to both agencies and SaaS providers,
  • expanding the catalog of mission-critical cloud solutions available to agencies.

The Armory is built on the FedRAMP authorized Assured Workloads Google Cloud Platform and includes configuration managed Google resources such as VPCs (Virtual Private Clouds), networking components, security controls, identity and access management (IAM) policies, and logging and monitoring mechanisms. The system also provides access to in-boundary tools for automation, configuration management, and account management. Each of these mechanisms has been configured to meet specific regulatory requirements such as International Traffic in Arms Regulations (ITAR), FedRAMP Class D (High) Rev. 5, and Department of Defense (DoD) Impact Levels 4/5 (IL 4/5).

The Armory provides ISVs, Enterprises and Agencies with access to pre-production staging environments and Google “Landing Zones”. These are securely architected environments that enable quick and compliant deployments, and a scalable foundation for their regulated cloud workloads. This secure standardized approach to creating and managing deployments allows government agencies and customers to easily deploy and manage their workloads while maintaining security, governance, and compliance.

ISV Partners:

  • Qanapi - As our inaugural ISV Partner, Qanapi’s FIPS-validated API service delivers state-of-the-art encryption and protection at the data level. Designed to safeguard sensitive, industry-regulated, and mission-critical data, Qanapi’s API seamlessly integrates into any software, device, or network. Built on a zero-trust architecture, it ensures robust security across organizations of all sizes, in both the public and commercial sectors. With Qanapi, organizations can achieve the highest level of data protection and compliance, regardless of their environment. Discover more at Quantum-Safe Data Security Platform | Qanapi - Visit product website
  • MxDR for Government – Accenture Federal Services' MxDR for Government is a managed security service designed specifically for federal agencies. Powered by Google SecOps, it offers 24/7 continuous threat detection, automated response, and threat-centric case management to help agencies rapidly neutralize cyber threats while maintaining strict regulatory compliance. Discover more at: MxDR for Government | Accenture - Visit product website
  • Armory SecOps - provides Google SecOps capabilities, security monitoring, detection engineering, triage, investigation support, dashboarding, and response workflow support for federal workloads that consume security operations services through The Armory.

Certified Services

Service(s) added in the last 90 days

  • None

Other Service(s)

  • Qanapi
  • MxDR for Government
  • Armory SecOps

Dependent Products

ProviderstackArmor
Cloud service offeringThe Armory
Service modelSaaS
Deployment modelGovernment-Only Cloud
Digital identityIAL3/FAL3/AAL3
UEIZ553Q1FPWYK5

Cybersecurity & Risk Management · Governance, Risk, and Compliance (GRC) · Development Tools · Operations Management · System Administration · Network Management

02 / Independent assessment

Independent evidence, clearly stated.

100%of baseline security controls assessed

Emagine IT, Inc completed The Armory's initial FedRAMP assessment from Jan 5, 2026 through Jul 8, 2026. Emagine IT supplied the overall summary for the initial FedRAMP assessment of The Armory, a FedRAMP Class D (High) Rev. 5 baseline system.

High0
Moderate4
Adjusted to low1
Low10
14SRTM test cases
1OS scan findings
0Web scan findings
0Database scan findings
0Container scan findings
0Penetration-test findings
1Operational requirements
03 / Certified services

One boundary. Multiple mission paths.

Hosted and managed landing zones, shared security services, and approved partner capabilities are maintained under The Armory's FedRAMP Class D (High) Rev. 5 program.

01 The Armory General Support System Available Jan 28, 2025

FedRAMP Class D (High) Rev. 5 GSS and SaaS platform that provides common security, compliance, networking, identity, vulnerability management, monitoring, incident response, compliance reporting, and secure landing zone capabilities for hosted and managed government workloads.

FedRAMP Class D (High) Rev. 5
02 Hosted Authorization Landing Zones Available Jan 28, 2025

Dedicated landing zones for ISV SaaS offerings deployed within The Armory authorization boundary. Hosted services are operated by the Armory team, documented in the Armory SSP, configuration controlled, continuously monitored, and assessed through the authorization or significant change process as applicable.

FedRAMP Class D (High) Rev. 5
03 Managed Authorization Landing Zones Available Jan 28, 2025

Secure Google Cloud landing zones for customers that maintain their own authorization boundary while leveraging Armory GSS instrumentation, deployment, and security services to support FedRAMP control implementation responsibilities.

FedRAMP Class D (High) Rev. 5
04 Qanapi Available Jan 28, 2025

Qanapi is a hosted tenant service within The Armory boundary that runs a containerized Laravel application on Cloud Run with a MySQL Cloud SQL backend and tenant-specific supporting components.

Visit product website
FedRAMP Class D (High) Rev. 5
05 Armory SecOps - SOC-as-a-Service Available Jul 1, 2026

Armory SecOps - SOC-as-a-Service is a hosted tenant service within The Armory boundary that supports SIEM reconciliation, inventory, and Bindplane management capabilities across documented Google Cloud regions.

FedRAMP Class D (High) Rev. 5
06 Accenture Federal Services MxDR Available Apr 17, 2026

Accenture Federal Services MxDR is a hosted tenant service within The Armory boundary that operates MxDR management capabilities in the AFS-BAS production project.

Visit product website
FedRAMP Class D (High) Rev. 5
04 / Package access

Public facts. Controlled evidence.

Certification metadata is public. Detailed package, configuration, monitoring, and change records are shared through the authenticated Trust Center with approved stakeholders.

Request authenticated access: The Secure Configuration Guide is stored in the Box Trust Center 01 Package Overview folder. Anyone who wants access should submit a formal package request through The Armory FedRAMP Marketplace listing request path or contact stackArmor through the established Trust Center access process. stackArmor reviews requests before sharing authenticated package materials.

Next ongoing certification reportOct 15, 2026
Next quarterly reviewOct 21, 2026
Public access 01

Trust Center, Authorization Package, Assessment Reports, Continuous Monitoring

Direct public JSON endpoint for The Armory FedRAMP Certification Overview Package.

Open resource
Authenticated access 02

Secure Configuration Guidance

Authenticated Box Trust Center location where The Armory Secure Configuration Guide Markdown and JSON artifacts are stored.

Open secure repository
Authenticated access 03

Security Decision Record

Authorization letters, cryptographic module inventory, minimum assessment scope inventories.

Open secure repository
Authenticated access 04

CR26 Package Overview

Repository for The Armory CR26 Certification Package Overview materials.

Open secure repository
Authenticated access 05

Rev. 5 Authorization Documentation

Repository for The Armory authorization package documentation meeting Rev. 5 documentation requirements.

Open secure repository
Authenticated access 06

Policy and Procedure Inventory

Authenticated human-readable inventory of policies and procedures included in The Armory FedRAMP Certification Data.

Open secure repository
Authenticated access 07

MxDR Secure Configuration Guidance

MxDR secure configuration guide in Markdown format.

Open secure repository
Authenticated access 08

Armory SecOps Secure Configuration Guidance

Armory SecOps secure configuration guide in Markdown format.

Open secure repository
Authenticated access 09

Qanapi Secure Configuration Guidance

Qanapi secure configuration guide in Markdown format.

Open secure repository
Authenticated access 10

Vulnerability and Incident Reporting

CR26 compliant vulnerability and incident reports.

Open secure repository
Authenticated access 11

Ongoing Certification Reports

Repository for ongoing certification reports, recording transcripts of previous OCR meetings, collaborative continuous monitoring charter, and ongoing certification meeting invite.

Open secure repository
Public access 12

Collaborative Continuous Monitoring, OCR Feedback Mechanism

Public Armory Trust Center where users can find the Collaborative Continuous Monitoring / OCR Feedback Mechanism and submit questions or feedback about Ongoing Certification Reports via gcp-organization-admins@stackarmor.com.

Open resource

No authentication is required. Open the public Armory Trust Center, find the Collaborative Continuous Monitoring / OCR Feedback Mechanism, and submit feedback via gcp-organization-admins@stackarmor.com.

Submit OCR feedback
Authenticated access 13

Collaborative Continuous Monitoring, OCR Feedback Addenda

Authenticated Trust Center location for anonymized and desensitized OCR feedback addenda.

Open secure repository
Authenticated access 14

Significant Change Notification, SCN Audit Records, Customer Notifications

Authenticated Trust Center location for Significant Change Notification Markdown and JSON artifacts, related SCN audit records, and approved SCN supporting materials.

Open secure repository
05 / Information resources

The services behind the boundary.

Authorized third-party platforms and controlled external update sources support The Armory's operating model.

FedRAMP-certified resources

FedRAMP IDUse within The Armory
FR1805751477Google Services provides the FedRAMP-authorized IaaS/PaaS foundation and underlying infrastructure for The Armory.
FR2131856836Okta IDaaS Government High Cloud provides SSO and adaptive MFA for privileged infrastructure users.
FR2230252267GovSlack provides operations notifications and alerts for privileged infrastructure users.
FR2000863987CloudFlare for Government provides 443 request forwarding and TLS proxy services for the Qanapi application.
F1603047866AWS GovCloud Simple Email Service provides transactional email for non-sensitive Qanapi account information.
F1212191840ABox Enterprise Cloud Content Collaboration Platform supports authorization package collaboration and documentation access workflows.
FR1919071020ASentinelOne Singularity Platform High provides endpoint security telemetry, endpoint detection and response, and workload protection alerting.

Controlled external resources

ResourceUse within The Armory
TSP® Tenable UpdatesTenableTLS update source for in-boundary Tenable software; transports system updates for privileged infrastructure users.
TSP® Trend Micro UpdatesTrend MicroTLS update source for in-boundary Trend Micro software; transports system updates for privileged infrastructure users.
TSP® GitLab UpdatesGitLabTLS update source for in-boundary GitLab software; transports system updates for privileged infrastructure users.
Linux UpdatesLinux operating system vendorsTLS update source for in-boundary Linux software; transports system updates for privileged infrastructure users.
Panorama UpdatesPalo Alto NetworksTLS update source for in-boundary Palo Alto Panorama software; transports system updates for privileged infrastructure users.
TSP® HashiCorp Packer Releases and PluginsHashiCorpTLS update and plugin source for approved Packer releases, plugins, checksums, signatures, and update metadata used to create approved RHEL images; no Federal customer data is transmitted.
TSP® Aqua Security Trivy Database and Checks UpdatesAqua SecurityTLS update source used during ThreatAlert Container Scanner runs for Trivy vulnerability databases, checks bundles, and update metadata; content is cached for scanning and no Federal customer data is transmitted.
TSP® Acunetix UpdatesAcunetixTLS update source for the in-boundary Acunetix web-application and API scanner engine, vulnerability-detection content, and update metadata; no Federal customer data is transmitted.
06 / Contacts

Questions deserve a clear path.

Contact the security or sales team for package access, certification questions, or Ongoing Certification Report feedback.

Use the source.
Verify the details.

View CPO JSON