FedRAMP information for CIPHER GRC
Last updated 12 November 2026
CIPHER GRC is working toward FedRAMP 20x Class C Certification. It is not certified yet. This page holds the public information FedRAMP asks every provider to share about its cloud service offering, and our progress toward certification is published separately.
The same information is published as JSON for FedRAMP and agency tools: https://www.ciphergrc.ai/fedramp/cipher-grc.json. This page and the JSON file are built from one data file, so they always match.
Service identification
| FedRAMP ID | CIPHER Platforms Incorporated - CIPHER GRC (placeholder until FedRAMP assigns an ID) |
|---|---|
| Provider | CIPHER Platforms Incorporated, a Traverge Company |
| Service name | Cybersecurity Intelligence & Provenance for Hybrid Enterprise Risk (CIPHER) Governance, Risk, and Compliance (GRC) (CIPHER GRC) |
| Certification type | FedRAMP 20x, Class C (in progress, not yet certified) |
| Service model | SaaS |
| Deployment model | Public Cloud |
| Business category | Governance, Risk, and Compliance (GRC); Cybersecurity & Risk Management; Artificial Intelligence (AI) |
| UEI number | YBHXHHJN9WU6 (parent company, Traverge Incorporated) |
| Product website | https://www.ciphergrc.ai |
| Product logo | https://www.ciphergrc.ai/images/cipher-grc-logo.png |
Service description
CIPHER GRC is a software-as-a-service governance, risk, and compliance platform for cloud service providers pursuing and maintaining FedRAMP Certification. It supports FedRAMP Rev5 packages and FedRAMP 20x continuous, telemetry-based certification, including Key Security Indicator results decided by policy-as-code, vulnerability detection and response, ITSM ticketing, a document library, and a trust center with review and approval before anything is published. Humans remain the decision-makers; Traverge subject matter experts and the Alan AI assistant provide recommendations only. CIPHER GRC is a product of CIPHER Platforms Incorporated, a Traverge Company. The UEI number given is that of the parent company, Traverge Incorporated.
Services and their security categories
These are the services included in the CIPHER GRC offering. Anything not listed here is not part of it.
| Packages and Requirements | System and package onboarding, FedRAMP Rev5 control and FedRAMP 20x Key Security Indicator tracking, and approval records for each package. Security category: Moderate. |
|---|---|
| Policy-as-Code (PaC) Key Security Indicators | Read-only collection of cloud configuration telemetry and fixed rules that decide each Key Security Indicator result. Security category: Moderate. |
| VDR/VER Vulnerability Tracking | Scan result import, PAIN rating, remediation dates and evidence tracking aligned to the FedRAMP vulnerability detection and response and evaluation rules. Security category: Moderate. |
| ITSM Ticketing | Compliance and security ticketing with role-based approvals and separation-of-duties support. Security category: Moderate. |
| Document Library | Role-gated library for the policies, procedures, plans and evidence files of a package. Security category: Moderate. |
| Trust Center | Staging, review and approval of certification data before it is published, with a separate portal for each agency. Certification data is shared with agencies on request. Security category: Moderate. |
| Alan AI Compliance Assistant | Answers compliance questions and drafts recommendations. All decisions are made and approved by humans. Security category: Moderate. |
Contacts
| Sales | Traverge Sales: contact@traverge.com, 904-257-6192 |
|---|---|
| Security | CIPHER Security Team: cipher-alerts@traverge.com |
Trust center, guidance and documentation
| Trust center | https://www.ciphergrc.ai/trust-center/ Landing page with instructions for requesting access to CIPHER GRC FedRAMP Certification Data as it becomes available, and links to the public information about the offering. |
|---|---|
| Secure configuration guidance | https://www.ciphergrc.ai/fedramp/secure-configuration/ Recommended secure configuration for CIPHER GRC top-level administrative and privileged accounts. |
| Documentation Overview | https://www.ciphergrc.ai/fedramp/documentation/ Overview of the documentation CIPHER Platforms supplies for CIPHER GRC. |
| Certification Progress | https://www.ciphergrc.ai/fedramp/progress/ Goals and milestones toward FedRAMP 20x Class C Certification, updated at least quarterly. |
| Next Ongoing Certification Report | Not applicable until CIPHER GRC is certified. |
| Independent assessor | Not yet engaged. |