UnifiedRespond™ GrowthEngine | The First End-to-End Agentic System for Growth Teams
Learn More

FedRAMP Certification Data Sharing — CDS-CSO-PUB

FedRAMP certification information for UnifiedRespond & UnifiedAcquire

This page publishes the information required under FedRAMP's Consolidated Rules for 2026 so that federal agencies, government contractors, and the public can review Rohirrim's certification status, contacts, and documentation in one place. This certification effort covers both Rohirrim cloud service offerings.

FedRAMP 20x Class A Certified

Certified 2 November 2026 · Ongoing Certification Phase · FedRAMP ID FR2632436493
Step 1
✓ Alternative framework in place
Step 2
✓ Marketplace Listing — Initial Implementation
Step 3
✓ Class A Certification
Step 4— Current
Ongoing Certification
Step 5
Class C Certification
Two Products, One Certification

Which product applies to you

Rohirrim operates two cloud service offerings on shared infrastructure, currently pursuing FedRAMP 20x Class A Certification. Depending on which side of a solicitation you're on, one of these is the reason this page matters to you.

FOR GOVERNMENT CONTRACTORS

UnifiedRespond

Helps government contractors research and draft responses to government solicitations, using retrieval-based AI to surface relevant material from an organization's own archive of prior proposal content.

Available: August 20, 2026

FOR GOVERNMENT AGENCIES

UnifiedAcquire

Helps government agencies write and issue solicitations to contractors, using the same underlying platform to draft clear, complete acquisition documents.

Available: August 20, 2026

Service Identity

How this certification is classified

Classification information applies to the cloud infrastructure being certified for both UnifiedRespond and UnifiedAcquire.

SERVICE NAME

Unified Acquisition Platform (UAP)

FedRAMP ID

FR2632436493

CERTIFIED
View on FedRAMP Marketplace ↗

Service Model

Software as a Service (SaaS)

Deployment Model

Government Community Cloud

BUSINESS CATEGORY

Artificial Intelligence (AI)

UEI Number

NYRPKZL34MZ4

Product Website

rohirrim.ai

Overall Service Description

Rohirrim operates two related cloud service offerings on shared infrastructure, serving both sides of the government solicitation process. UnifiedRespond helps government contractors in the defense, aerospace, health, and energy sectors research and draft responses to solicitations, ingesting an organization's own archive of prior proposal content and using retrieval-based AI to surface relevant material and draft on-target technical responses. UnifiedAcquire helps government agencies write and issue those same solicitations, using the same underlying platform to draft clear, complete acquisition documents. Both offerings reduce manual research and drafting burden without displacing the judgment of the people using them.
Product logo
Boundary

What the service runs on

Third-party information resources within the FedRAMP Minimum Assessment Scope, consistent with the CUI Enclave documented in Rohirrim's System Security Plan.

Third-Party Information Resources

The entire CUI Enclave runs on Microsoft Azure Government (FedRAMP ID F1603087869). Every platform component in use — identity, compute, database, storage, messaging, secrets management, and networking — operates within this same FedRAMP High-authorized boundary. Azure OpenAI Service, which provides the generative AI inference behind UnifiedRespond and UnifiedAcquire, is confirmed within Azure Government's FedRAMP High audit scope as well — it is not a separate third-party relationship.
Points of Contact

Who to reach, for what

Separate contacts are maintained for commercial and security-related inquiries, consistent with FedRAMP's requirement to route these separately from general support channels.

Sales contact
Christian Meyer
[email protected]
Security Contact (General)
Mike Papay, CISO
[email protected]
Security Contact
FedRAMP Security Inbox
[email protected]
Reporting a Vulnerability
[email protected]
Independent security researchers should read our Vulnerability Disclosure Program, available through the Trust Center, before testing. It sets out what is in scope, the rules of engagement, and the safe harbor for good-faith research. Machine-readable contact details are published at /.well-known/security.txt per RFC 9116.
Documentation & Configuration

What we've published, and where to find more

An overview of the governance documentation supporting this certification, plus guidance for securely configuring and administering the service.

Detailed Service List & Security Categories
UnifiedRespond and UnifiedAcquire, both hosted within the CUI Enclave documented in Rohirrim's System Security Plan. Security category: Moderate (confidentiality, integrity, availability), proposed and pending formal adoption by the Authorizing Official, consistent with our FedRAMP 20x Class C target.
CONFIRMED
Secure Configuration Guide
Pending — In Development
PENDING
Trust Center
Rohirrim Trust Center ↗
AVAILABLE

Published governance documentation

Thirteen documents are published to the Trust Center. The full FedRAMP set comprises twenty-eight approved policies and procedures; the remainder are written for Class C and will be published as that certification is pursued.

Access Control Policy

FedRAMP · Approved 19 Aug 2026

Awareness and Training Policy

FedRAMP · Approved 24 Sep 2026

Configuration Management Policy

FedRAMP · Approved 19 Aug 2026

Identification and Authentication Policy

FedRAMP · Approved 19 Aug 2026

Incident Response Policy

FedRAMP · Approved 24 Sep 2026

Maintenance Policy

FedRAMP · Approved 21 Jul 2026

Media Protection Policy

FedRAMP · Approved 23 Sep 2026

Personnel Security Policy

FedRAMP · Approved 23 Sep 2026

Physical and Environmental Protection Policy

FedRAMP · Approved 23 Sep 2026

Risk Assessment Policy

FedRAMP · Approved 23 Sep 2026

System and Communications Protection Policy

FedRAMP · Approved 19 Aug 2026

System and Information Integrity Policy

FedRAMP · Approved 19 Aug 2026

Vulnerability Disclosure Program

v1.0 · 5 Nov 2026

Full certification package materials, including this documentation in detail, are available to authorized parties through the Trust Center linked above.
CERTIFICATION STATUS

Where things stand today

Rohirrim received its FedRAMP 20x Class A Certification from the FedRAMP Program Management Office on 2 November 2026 and has entered the Ongoing Certification Phase. A Class A Certification has no fixed expiration date and remains in effect for as long as the service continues to meet the applicable ongoing certification requirements.

Next Ongoing Certification Report

Due no later than November 24, 2026

FedRAMP Recognized Assessor

Not applicable at Class A — Alternative Security Framework (SOC 2 Type II) used per FRC-CLA-ASF
A FedRAMP Recognized independent assessment service has been engaged for the Class C assessment and will be named here when that assessment begins.

Path to Class C

A Class A Certification is an entry point to the FedRAMP Marketplace rather than a final destination. Rohirrim is pursuing a FedRAMP 20x Class C Certification and expects to achieve it in early 2027.

Independent assessment by a FedRAMP Recognized assessment service

Assessor engaged · Early 2027

Automated validation and evidence collection across the Class C Key Security Indicators

In progress

Publish the FedRAMP procedure set written for Class C

Approved · Publication pending

Publish the Secure Configuration Guide

In development

Policy-aligned secure development training for engineering staff

Deployed · Q4 2026

Ongoing Certification Reports are published on the schedule shown above and record certification data changes, accepted vulnerabilities and any reportable incidents.
This page is maintained to comply with FedRAMP Certification Data Sharing rule CDS-CSO-PUB (FedRAMP Consolidated Rules for 2026).
Last updated: 09 November 2026 • ROHIRRIM.AI