Verified vs. Self-Attested: What Federal Buyers Actually Check

Note on terms: The Consolidated Rules retired “Authorized” as the status term: the status a cloud service holds is now FedRAMP Certified. Where this post says “authorization” generically, read “certification”.

With the FedRAMP 20x Class A pipeline open since August 3, 2026 and Class B and C since August 31, a lot of software companies are putting “compliant” on a slide. Federal buyers — and the prime contractors evaluating you as a subcontractor — don’t read that word the way commercial buyers do. They read past it to a single question:

Who checked this, and against what standard?

That question is the whole game. Getting it right is the difference between a compliance posture that opens doors and one that quietly gets you screened out before anyone picks up the phone.

The three states of a compliance claim

Not all “we’re compliant” statements carry the same weight. There are three distinct states, and federal evaluators are trained — often contractually obligated — to tell them apart.

1. Unverified assertion. “We encrypt data at rest. We enforce least-privilege access.” A statement about yourself, backed by nothing an evaluator can pull. In a federal context this is worth roughly what any marketing copy is worth: it’s a starting point for questions, not an answer.
2. Self-attestation. A vendor formally attests to its own posture — a signed self-assessment, a completed questionnaire, a claimed control set. This is more than marketing: someone put their name on it. But the examiner is still the vendor. Self-attested compliance is not verified compliance, and the acquisition process is explicitly built to find the gap between the two.
3. Independently verified. A third party with no stake in the outcome examined the evidence and issued a result an evaluator can check: an authorization listed on the FedRAMP Marketplace, a SOC 2 Type II report from an independent CPA firm, a CMMC assessment by an authorized assessor. The claim now has provenance — a chain an evaluator can follow back to someone who isn’t you.

Federal buyers discount states 1 and 2 not out of cynicism but out of design. The entire apparatus of federal acquisition — the questionnaires, the continuous-monitoring requirements, the assessor ecosystem — exists precisely because a buyer cannot take a vendor’s word for its own security.

The SOC 2 trap

Here is the misread that costs ISVs the most. A SOC 2 Type II report is independently examined — it sits in state 3, not state 2. So a company that holds one reasonably feels verified. The trap is assuming that verification carries over to the federal ask. It does not automatically. SOC 2 attests to controls against the AICPA Trust Services Criteria; a FedRAMP authorization attests to a federal baseline. They overlap, but a federal buyer is checking for the federal standard, verified by the federal process.

The lesson is not “SOC 2 doesn’t matter” — it matters a great deal as a foundation. The lesson is that who verified it and against which standard are two separate axes, and federal buyers read both. A real SOC 2 plus an honest map of what still needs federal verification reads as competence. A SOC 2 waved as though it were a FedRAMP authorization reads as a company that hasn’t done its homework.

How GovExpress makes the distinction legible

GovExpress’s compliance overlay exists to render exactly this axis. It shows FedRAMP, CMMC, and SOC 2 status on every vendor you search in the app and, for each claim, distinguishes verified status from self-reported status — with the source and observation date behind each verified mark, so a posture can be read the way a contracting officer would read it rather than the way a pitch deck presents it. Where a public source is unavailable, it says “Insufficient data” instead of guessing; the GSA FedRAMP list it reads has been unreachable for long stretches since mid-2026, so a verified FedRAMP mark is often simply absent.

For a company preparing a FedRAMP 20x submission, that turns a vague worry — “are we actually ready, or do we just feel ready?” — into something you can see: which of your compliance claims would survive an evaluator pulling the thread, and which are still self-attested and need independent backing before they’ll count.

Where deals die — and how a legible posture shortens the path

Federal deals rarely die at “no.” They die in due diligence, in the weeks where an evaluator maps your claims against evidence and finds a gap you didn’t flag first. Every gap discovered by them rather than disclosed by you costs twice: once in the finding, once in the trust. A posture that already distinguishes verified from self-attested — and says plainly which is which — shortens diligence because it front-runs the exact questions the process is built to ask.

That is the quiet advantage for any submitter: not claiming more, but claiming legibly. The companies that walk in already knowing which of their claims are verified, which are self-attested, and what the plan is to close the difference are the ones diligence moves through quickly instead of stalling on.

Know which of your compliance claims are verified — before a federal evaluator tells you.

Map your compliance posture against the federal standard before you submit.

Related reading

• FedRAMP 20x Class A pipeline explained
• FedRAMP 20x timeline for SaaS vendors
• How to sell software to the federal government
• GSA Schedule for SaaS vendors
• Federal TAM sizing for ISVs