The 2026 Federal Readiness Playbook for ISVs — Chapter 6 (Appendix): The Six Federal Data Sources

Where the number comes from

Chapter 5 closed on a claim it deliberately left the appendix to back up: that the readiness score under your 90-day plan is computed from observable public federal data. Your own full report also uses what you tell us in the intake, the things public data cannot see, but those answers are shown labelled self-reported, never passed off as a verified record. That distinction is the whole reason the score means anything. A self-graded number is a mirror; a number built from the same public records a federal buyer can pull is a second opinion — and a second opinion is the only kind worth paying for.

So the book closes where its credibility comes from. This appendix names the sources behind the readiness picture at the level a buyer, partner, or investor needs when they ask “where does this come from?” — these are public federal APIs, and here is the short, checkable list. What it does not do is open the hood on how the score is calculated; the scoring engine is deterministic and proprietary, and this chapter keeps to the sources, not the arithmetic.

Six public federal APIs

GovExpress ingests six live federal data APIs. Every call is server-side only, and only the public tier of each source is read — no controlled unclassified information (CUI) is ingested. Nothing here requires a customer to hand over anything a federal buyer could not already look up.

#	Source	What it is (public record)	What it informs
1	SAM.gov (Entity + Opportunities)	The government’s system of record for who is registered to do business with it, and the live opportunity postings	Registration and identity — are you registered, active, and findable — and the active opportunities pipeline
2	USASpending.gov	The public ledger of federal award spending	Award history and market context. Every dollar figure in a report traces here — the single authoritative source for spend
3	FPDS via SAM.gov	Federal Procurement Data System contract-action records	The contract-action detail behind the spending picture (the legacy ezSearch front end was decommissioned Feb 2026; the data is read through SAM.gov)
4	FedRAMP data (GSA)	The public FedRAMP authorization list published by GSA	Cloud-authorization status for the compliance overlay — see the note below on what happens when a source is unavailable
5	GSA CALC+	Published federal labor-rate benchmarks	Pricing and financial context — what comparable federal labor actually costs
6	SBIR.gov	The public SBIR / STTR innovation-award record	Innovation and early federal traction, especially for first-time sellers

Read that list as one sentence: registration, spending, contract actions, compliance authorizations, labor pricing, and innovation awards — six public angles on the same company, pulled from records the buyer trusts because the government publishes them. The score’s job is to read them consistently; the sources’ job is to make sure it is reading reality, not a self-description.

When a source is unavailable — the tool says so

Honesty about the sources includes honesty about when one is down. Public federal feeds do go dark: an upstream list gets moved or renamed, a refresh returns nothing, an API is down for maintenance. This is not hypothetical here. The GSA-published FedRAMP list this tool reads has been unreachable for long stretches since mid-2026, and while it is, the overlay has no verified FedRAMP status to show for anyone.

What matters for trust is what happens next. The compliance dimension does not paper over a gap with a guess or a stale cache — it degrades gracefully to “Insufficient data.” A tool that invents a compliance status when its source is unreachable is worse than useless to a federal buyer; a tool that says plainly “I could not verify this right now” is behaving the way the rest of this book argues you should.

The lesson generalizes to every feed: a source that is down should read as “unknown,” never as “compliant.” That is the same verified-versus-self- attested discipline from Chapter 3, applied to the plumbing.

What these sources are not

Three limits are worth stating plainly, because getting them wrong is exactly the kind of overclaim this book warns against elsewhere.

• They are not a government-side scoring system. GovExpress reads public federal APIs. It does not have — and does not claim — visibility into any government-only or restricted internal scoring or risk system. The readiness picture is assembled entirely from the company’s own compliance overlay and the public records above; it is an outside-in read, not a peek at a government dashboard.
• They are not a source of financial totals to be summed into a headline number. The data supports a company’s own readiness read; it is not used to add up multi-award ceiling values or any “total federal footprint” figure. Spending is reported as award history at the level USASpending publishes it — presence and engagement, not a manufactured grand total.
• They do not turn a self-attested claim into a verified one by themselves. A public record confirms what the government published; independent verification is still what separates a checkable compliance posture from a self-attestation (Chapter 3). The sources make claims legible; they do not launder them.

How the sources map to what you can act on

You do not need the internal weighting to use this. Each source lines up with a part of the readiness picture the earlier chapters already gave you a handle on:

• SAM.gov is the table-stakes, gating dimension from Chapter 5 — an unregistered, unfindable vendor is not evaluated at all.
• USASpending and FPDS are where past performance and federal market-fit show up as real, dated activity rather than a claim.
• FedRAMP data feeds the compliance overlay — the verified-versus-self- attested layer that Chapters 3 and 5 treat as the highest-leverage place to do ninety days of work.
• GSA CALC+ and SBIR.gov round out pricing realism and early-traction evidence — the parts a first-time seller most often underweights. The point of naming them is not to teach you to query them by hand. It is so that when the score says a dimension is thin, you can trace why to a public record and go fix the real thing — not game a questionnaire.

Closing the book

The manuscript began (Chapter 1) with a dated window — FedRAMP 20x Class A opened 2026-08-03, Class B and C on 2026-08-31 — and argued the first movers hold an advantage the latecomers cannot buy back. Everything between then and here was one argument in six parts: readiness can be scored (Ch 2), a compliance claim is only worth what its verification is (Ch 3), the clock you are racing has two calendars and you must name which one (Ch 4), and a score becomes motion only as a sequenced 90-day plan (Ch 5).

This appendix is the foundation the other five rest on. A plan is only as trustworthy as the diagnosis under it, and the diagnosis is only as trustworthy as its sources. Six public federal APIs, read server-side, at the public tier, with any unavailable feed honestly flagged rather than faked — that is where the number comes from, and that is the answer you can hand to anyone who asks.