UnifiedRespond™ GrowthEngine | The First End-to-End Agentic System for Growth Teams
Learn More

FedRAMP Certification Data Sharing — CDS-CSO-PUB

FedRAMP certification information for UnifiedRespond & UnifiedAcquire

This page publishes the information required under FedRAMP's Consolidated Rules for 2026 so that federal agencies, government contractors, and the public can review Rohirrim's certification status, contacts, and documentation in one place. This certification effort covers both Rohirrim cloud service offerings.

Step 1
✓ Alternative framework in place
Step 2
✓ Marketplace Listing — Initial Implementation
Step 3 — Current
Building Toward Class A Certification
Step 4
Ongoing Certification
Two Products, One Certification

Which product applies to you

Rohirrim operates two cloud service offerings on shared infrastructure, currently pursuing FedRAMP 20x Class A Certification. Depending on which side of a solicitation you're on, one of these is the reason this page matters to you.

FOR GOVERNMENT CONTRACTORS

UnifiedRespond

Helps government contractors research and draft responses to government solicitations, using retrieval-based AI to surface relevant material from an organization's own archive of prior proposal content.

Available: August 20, 2026

FOR GOVERNMENT AGENCIES

UnifiedAcquire

Helps government agencies write and issue solicitations to contractors, using the same underlying platform to draft clear, complete acquisition documents.

Available: August 20, 2026

Service Identity

How this certification is classified

Classification information applies to the cloud infrastructure being certified for both UnifiedRespond and UnifiedAcquire.

SERVICE NAME

Unified Acquisition Platform (UAP)

PROVIDER

Rohirrim, Inc.

CERTIFICATION TYPE

FedRAMP 20x

FedRAMP ID

FR2632436493

ASSIGNED
View on FedRAMP Marketplace ↗

Service Model

Software as a Service (SaaS)

Deployment Model

Government Community Cloud

BUSINESS CATEGORY

Artificial Intelligence (AI)

UEI Number

NYRPKZL34MZ4

Product Website

rohirrim.ai

Overall Service Description

Unified Acquisition Platform is Rohirrim's certified cloud infrastructure supporting two complementary offerings for the government solicitation lifecycle: UnifiedRespond, used by government contractors to research and draft responses to solicitations, and UnifiedAcquire, used by government agencies to write and issue those solicitations. Both offerings are software packages running inside the same authorization boundary, sharing the same retrieval-based AI platform, identity plane, data stores, and monitoring.
Product logo
Boundary & Architecture

What's inside the boundary, and how data moves through it

Third-party information resources and information flows within the FedRAMP Minimum Assessment Scope, consistent with the CUI Enclave documented in Rohirrim's System Security Plan.

Third-Party Information Resources

The entire CUI Enclave runs on Microsoft Azure Government (FedRAMP ID F1603087869). Every platform component in use — identity, compute, database, storage, messaging, secrets management, and networking — operates within this same FedRAMP High-authorized boundary. Azure OpenAI Service, which provides the generative AI inference behind UnifiedRespond and UnifiedAcquire, is confirmed within Azure Government's FedRAMP High audit scope as well — it is not a separate third-party relationship.
Information Flows

Two access paths lead into the enclave, both converging at the same enforcement point before reaching any CUI-processing components:

  • DoD prime contractors with active CMMC Level 2 certifications connect over HTTPS through Azure Front Door, which performs Web Application Firewall inspection and TLS termination at the internet-facing edge.

  • Internal Rohirrim users connect through Azure Bastion, a browser-based jump host in a dedicated subnet requiring multi-factor authentication, with every session recorded.

Both paths converge at Azure Firewall, which enforces network filtering for all inbound, outbound, and east-west traffic before any connection reaches the application or data tiers. All connections are encrypted in transit using TLS 1.2 or higher, and all external access is logged to Azure Log Analytics and forwarded to Microsoft Sentinel for continuous monitoring, consistent with NIST SP 800-53 AU-2 and AU-6.
Explicitly Out of Scope

The following do not process or store CUI and maintain no connection into the enclave:

  • Rohirrim's corporate Microsoft 365 tenant
  • Jira (change management and ticketing only)
  • Vanta (continuous compliance monitoring and evidence collection only)
  • Cloudflare (DNS resolution only)
Points of Contact

Who to reach, for what

Separate contacts are maintained for commercial and security-related inquiries, consistent with FedRAMP's requirement to route these separately from general support channels.

Sales contact
Christian Meyer
christian@rohirrim.ai
Security Contact (General)
Mike Papay, CISO
mike.papay@rohirrim.ai
Security Contact
FedRAMP Security Inbox
FedRAMP.Security@gov.rohirrim.ai
Documentation & Configuration

What we've published, and where to find more

An overview of the governance documentation supporting this certification, plus guidance for securely configuring and administering the service.

Detailed Service List & Security Categories
UnifiedRespond and UnifiedAcquire, both available since August 20, 2026 and running inside the same authorization boundary. Security category: Moderate (proposed, pending formal adoption by the Authorizing Official).
PROPOSED
Secure Configuration Guide
Pending — In Development
PENDING
Trust Center
Rohirrim Trust Center ↗
AVAILABLE
Authentication required.
What's in the Trust Center, and how to get access

The Trust Center holds the Certification Package Overview, Security Decision Record, Ongoing Certification Report, sample incident reports, the twelve FedRAMP policies, the component inventory artifacts, and the external assessment materials supporting this certification.

Request viewer access using the Trust Center link above. Requests are reviewed by Rohirrim's security team; approved requesters receive an email invitation to create an account and view shared compliance materials. Agency requests are granted on request per CDS-UTC-AGA.

Governance documentation on file

Access Control Policy

FedRAMP · v1.0

Identification and Authentication Policy

FedRAMP · v1.0

System and Communications Protection Policy

FedRAMP · v1.0

System and Information Integrity Policy

FedRAMP · v1.0

Incident Response Policy

FedRAMP · v1.0

Configuration Management Policy

FedRAMP · v1.0

Awareness and Training Policy

FedRAMP · v1.0

Personnel Security Policy

FedRAMP · v1.0

Media Protection Policy

FedRAMP · v1.0

Risk Assessment Policy

FedRAMP · v1.0

Physical and Environmental Protection Policy

FedRAMP · v1.0

Maintenance Policy

FedRAMP · v1.0

The twelve policies above are available to authorized parties through the Trust Center. Rohirrim's sixteen FedRAMP procedures are approved but not published: they are scoped to Class C, and CDS-CSO-IRP applies from Class B.
CERTIFICATION STATUS

Where things stand today

Rohirrim's FedRAMP Marketplace listing was approved on August 21, 2026 (FedRAMP ID FR2632436493). The fields below will be completed as each subsequent milestone toward full Certification is reached, rather than filled in advance.

Next Ongoing Certification Report

Due no later than November 24, 2026

FedRAMP Recognized Assessor

Not applicable at Class A — Alternative Security Framework (SOC 2 Type II) used per FRC-CLA-ASF

Progress Toward Certification

Measured against our own documented goals and milestones, reviewed and republished at least quarterly.

Align engineering security training with Rohirrim's own Secure Development Policy

Target: Q4 2026

Complete independent verification of automated account lifecycle management

Target: Q4 2026

Close remaining enhancements identified in our annual incident response exercise

Target: Q4 2026

Next scheduled update: no later than November 22, 2026.
Third-Party Information Resources

What the service runs on

FedRAMP-certified third-party resources the service depends on. Rohirrim uses no non-certified third-party information resources.

FedRAMP Certified
Microsoft Azure Government

Hosts the entire cloud service offering: compute, storage, identity, network, AI inference, secrets management, monitoring, and physical infrastructure. Holds a FedRAMP High provisional authorization and is authorized for CUI under DFARS 252.204-7012. Physical, environmental, and platform controls are inherited per Microsoft's published Customer Responsibility Matrix. Rohirrim operates a dedicated subscription isolated from any commercial Azure tenancy, with enclave-level segmentation, customer-managed secrets in Key Vault, encryption at rest and in transit, and independent monitoring through Microsoft Sentinel and Defender for Cloud.
This page is maintained to comply with FedRAMP Certification Data Sharing rule CDS-CSO-PUB (FedRAMP Consolidated Rules for 2026).
Last updated: 06 October 2026 • ROHIRRIM.AI