IronWiFi Cloud RADIUS and Wi-Fi Authentication Platform, FedRAMP ID FR2631154499. Cloud RADIUS, 802.1X with EAP-TLS, cloud PKI with SCEP enrollment, captive portals and Wi-Fi identity threat detection, delivered as SaaS on Google Cloud with US regions available.
IronWiFi is in the FedRAMP Initial Implementation Phase and is not FedRAMP Certified today. Nothing on this page is a claim that it is. The public information below is published per CDS-CSO-PUB.
Public information for the IronWiFi cloud service offering, per FedRAMP rule CDS-CSO-PUB under the Consolidated Rules for 2026.
| Provider | IronWiFi, LLC |
|---|---|
| Cloud Service Offering | IronWiFi Cloud RADIUS and Wi-Fi Authentication Platform |
| FedRAMP ID | FR2631154499 |
| Marketplace listing | FR2631154499 on the FedRAMP Marketplace |
| Marketplace Status | Initial Implementation Phase, approved 12 August 2026. Status: Not yet certified. Authorizations: 0. |
| Certification Type | FedRAMP 20x |
| Certification Path | Program |
| Certification Class | Unknown (as listed on the FedRAMP Marketplace, checked 18 September 2026). Class A is the entry certification IronWiFi applied for on 13 September 2026; FedRAMP records the class on the listing when it decides the application. |
| Service Model | SaaS |
| Deployment Model | Public Cloud |
| Business Category | Cybersecurity & Risk Management; Network Management |
| UEI Number | TB1XW4HNNUG9 |
| Sales Contact | IronWiFi Sales, [email protected], 800-963-6221 |
| Security Contact | IronWiFi Security Team, [email protected] |
| Product Website | www.ironwifi.com |
| Product Logo | ironwifi.png |
| Next Ongoing Certification Report | Not applicable until FedRAMP Certification (CCM-OCR-NRD). Target for the first report after certification: 15 December 2026. That date is a goal, not a current reporting obligation. |
| Independent Assessment Service | No FedRAMP Recognized independent assessment service is currently engaged for this offering. Independent verification today is the annual SOC 2 Type II audit; the report is available in the Trust Center. |
IronWiFi is a cloud-native SaaS providing RADIUS authentication (802.1X / EAP-TLS), captive portals, cloud PKI with SCEP certificate enrollment, and Wi-Fi identity threat detection (ITDR). It authenticates users and devices against enterprise identity providers including Microsoft Entra ID (commercial and GCC High), Google Workspace, Okta, and LDAP/Active Directory, across wireless hardware from any vendor whose access points and controllers support RADIUS and 802.1X. The service is vendor-neutral: agencies keep their existing access points and switches while IronWiFi provides the authentication, policy, and monitoring layer.
IronWiFi is in the Initial Implementation Phase: listed in the FedRAMP Marketplace (status Not yet certified, Certification Class Unknown) with a FedRAMP 20x Class A Certification application submitted on 13 September 2026 and awaiting FedRAMP's decision. The offering is not FedRAMP Authorized or FedRAMP Certified today, and nothing on this page should be read as a claim that it is. FIPS 199 Moderate is the impact categorization of this offering. It is not a FedRAMP Moderate Authorization. Under the 2026 rules, Class C replaced the Moderate baseline; Class A is the entry certification.
Agency use case. Both apply. Direct Use: agencies run IronWiFi as the authentication, policy and monitoring layer for their own wireless and wired networks, inside a federal information system that receives an agency Authorization to Operate. Indirect Use: integrators and managed service providers include IronWiFi as a third-party information resource in offerings they deliver to federal customers.
| Done · 7 May 2026 | SOC 2 Type II report issued by Johanson Group LLP, unqualified opinion. This is the qualifying alternative security framework for a FedRAMP 20x Class A Certification, and it is renewed annually. |
|---|---|
| Done · 12 Aug 2026 | FedRAMP Marketplace listing approved for the Initial Implementation Phase. FedRAMP ID FR2631154499 assigned. |
| Done · 12 Aug 2026 | Public certification data published in human-readable and machine-readable form, validated against the FedRAMP Certification Package Overview schema. |
| In progress | Key Security Indicator evidence: the Security Decision Record records five indicators Implemented and two Partially Implemented with the residual risk stated and accepted by the accountable official; remediation continues on the published plan and is reported at each quarterly update. |
| Published · 13 Sep 2026 | IronWiFi-prepared 20x Class A package documents (version 1.4): Certification Package Overview, Security Decision Record covering every applicable rule and Key Security Indicator, example Ongoing Certification Report, Secure Configuration Guide, policy register and component inventory. These are provider materials on this site and in the Trust Center. They are not a FedRAMP Certification, and FedRAMP has not yet accepted them as a Class A package. |
| Submitted · 13 Sep 2026 | FedRAMP 20x Class A Certification application (FRC-APP-AFC) submitted to FedRAMP through the FedRAMP help desk. FedRAMP's decision is pending; until it is recorded, the Marketplace listing stays Not yet certified and Class Unknown. This row is updated with the outcome and date when FedRAMP responds. |
| Planned · decision by Q3 2027 | Select and schedule a FedRAMP Recognized independent assessment service for a higher certification class, which FedRAMP requires to be scheduled within two years of the Initial Implementation listing. |
Progress is measured against the milestones above and this section is updated at least quarterly, per FedRAMP rule MKT-IIP-DCP. Targets are goals rather than commitments and are reviewed at each update. Last updated 19 September 2026; next update by 19 December 2026. Questions from agencies: [email protected].
The twenty names below are the services in this offering listed in the machine-readable overview (schema field certifiedServices). That field name is FedRAMP's; it does not mean the offering is FedRAMP Certified. Each carries the same FIPS 199 categorization. Device Trust is marketed as Coming Soon and is not in this offering. AI Agent Identity, Passwordless WiFi and the OpenRoaming OSU signup server are separate marketing pages and are not in this offering.
Every service below is part of the single multi-tenant IronWiFi platform that constitutes this cloud service offering (CDS-CSO-SVC). Names match those used in public marketing materials; each links to its product page.
Security categories: the FIPS 199 security categorization for this offering, approved 24 August 2026, is Confidentiality Moderate, Integrity Moderate, Availability Low - overall Moderate. That is an impact categorization. It is not a FedRAMP Moderate Authorization and it is not a 20x Class C certification. It applies identically to every service listed above: all services share the same tenancy, data stores and credential material, so no service carries a different category. Scope and control detail are available from [email protected].
Google Cloud (FR1805751477) hosts the offering. FedRAMP High P-ATO inheritance is Not claimed: the offering does not run in an Assured Workloads environment, so Google Cloud's authorization does not authorize IronWiFi.
FedRAMP Certification Data, audit reports, control listings, and subprocessor listings are published in the IronWiFi Trust Center. The landing page and its Controls and Subprocessors sections are open, with no account required. Under Resources, the SOC 3 report, Data Processing Agreement and Terms of Service open directly via View. The FedRAMP Documentation category holds the certification package: the public information link opens directly, the complete bundle is downloadable without an account from the URL below, and the individual documents (Security Decision Record in PDF and JSON, Certification Package Overview PDF, Key Security Indicator Summary PDF, example Ongoing Certification Report in PDF and JSON, component inventory with its method and script, and the manifest) are released on request via Request access. The SOC 2 Type II report is gated: select Request access on that resource; requests are reviewed and access is granted to the requesting email address under a non-disclosure agreement. Questions about a request, or federal agency requests that need a different route, go to [email protected].
All public FedRAMP Certification Data for this offering is retrievable without authentication, at stable URLs, by any HTTP client:
https://www.ironwifi.com/fedramp/ironwifi-fedramp-public.jsonhttps://www.ironwifi.com/fedramp/https://www.ironwifi.com/fedramp/IronWiFi-FedRAMP-20x-ClassA-Package.ziphttps://trust.ironwifi.com/doc/trust-zip?r=8a9wpl33zl9c7j1645r56https://www.ironwifi.com/dpaThe SOC 2 Type II report is released per person under a non-disclosure agreement and is deliberately not available programmatically; request access through the Trust Center resource or [email protected]. The inventory and history of federal agency users granted Trust Center access (CDS-TRC-AAI), and any party's log of its own Trust Center activity (CDS-TRC-ACL), are maintained in the Trust Center platform's access-request and viewer-activity records and are available to FedRAMP and to the party concerned on request to [email protected].
Secure Configuration Guide for federal deployments (SCG-CSO-RSC) - the tenant owner and privileged accounts, their secure access, configuration, operation and decommissioning, secure defaults, and the tenant settings recommended for agency use; also as JSON and as a PDF in the package bundle.
Machine-readable JSON (CDS-CSO-PUB)The JSON document is valid against the FedRAMP Certification Package Overview schema (2026-06-24) and is kept consistent with this page by an automated check in the site build.