FedRAMP Authorized — Moderate Impact
Qualys GovCloud by Qualys. 6 compliance features verified.
Qualys GovCloud
by Qualys
Impact Level
Moderate
Status
Authorized
Pricing
mid market
Authorization Date: October 18, 2017 | Sponsoring Agency: GSA
Overview
Qualys GovCloud provides FedRAMP Moderate authorized cloud-based security and compliance solutions including vulnerability management, policy compliance, and web application scanning. It offers a unified platform for IT security and compliance visibility across hybrid environments. The platform automates compliance assessments against government benchmarks.
Key Features
Certifications & Authorizations
Deployment Options
NIST 800-171 Compliance Coverage
How to Procure Qualys GovCloud for Defense Contracts
Qualys GovCloud is available through GSA Multiple Award Schedule (MAS) under SIN 518210C (IT Professional Services) and SEWP V contracts. Government pricing typically reflects 20-30% discount from commercial rates with volume discounts for enterprise licenses exceeding 10,000 assets. The authorization boundary encompasses the Qualys cloud platform, scanning engines, and management console - contracting officers must ensure customer data handling agreements align with agency classification levels. Required documentation includes the FedRAMP security package, customer responsibility matrix (CRM), and incident response procedures. Standard procurement timeline spans 90-120 days including technical evaluation, security review, and ATO documentation. For CMMC assessments, include Qualys GovCloud within your assessment boundary as a critical security control provider supporting vulnerability management (AC.L2-3.1.18), system monitoring (AU.L2-3.3.1), and configuration management (CM.L2-3.4.6). Ensure contractual language addresses data location requirements, encryption in transit/at rest, and audit log retention periods. The service supports continuous monitoring requirements and can integrate with existing security orchestration platforms.
Compliance Cross-References
Qualys GovCloud's FedRAMP Moderate authorization directly supports DFARS 252.204-7012 safeguarding requirements by providing vulnerability scanning (3.11.2), security assessment capabilities (3.11.3), and audit logging (3.3.1-3.3.9). For DFARS 252.239-7010 cloud computing compliance, the platform maintains required security controls, incident response capabilities, and data location restrictions within CONUS. NIST 800-171 control families are comprehensively addressed: Access Control (AC) through role-based scanning permissions, System and Communications Protection (SC) via encrypted data transmission and storage, and Audit and Accountability (AU) through detailed vulnerability and compliance reporting. CMMC Level 2 domain alignment includes Asset Management (AM) for inventory discovery, Vulnerability Management (RA) for risk assessment and remediation tracking, and Situational Awareness (SA) for continuous monitoring. The platform's DoD Cloud Computing SRG IL2 authorization ensures appropriate security controls for CUI processing, including data segregation, encryption standards, and personnel security requirements essential for defense contractors.
Defense Contractor Use Case
Defense contractors use Qualys GovCloud for vulnerability management and compliance auditing, generating automated reports for CMMC assessments and continuous monitoring requirements.
Related Products
More Security Products
Related Compliance Assessments
Frequently Asked Questions
What is the FedRAMP authorization level for Qualys GovCloud?
Qualys GovCloud is authorized at the FedRAMP Moderate impact level, with authorization granted on 2017-10-18 sponsored by GSA. The FedRAMP Moderate baseline includes approximately 325 security controls covering confidentiality, integrity, and availability.
Can defense contractors use Qualys GovCloud for CUI?
Qualys GovCloud is authorized at the FedRAMP Moderate baseline. While FedRAMP Moderate covers a broad range of government data, defense contractors handling CUI should carefully evaluate whether Moderate controls meet their specific DFARS 252.204-7012 and NIST 800-171 requirements. Some CUI categories may require FedRAMP High authorization depending on the sensitivity of the data and contract requirements.
How does Qualys GovCloud pricing compare to commercial?
Qualys GovCloud government pricing is generally competitive with commercial pricing, though the government edition may carry a premium of 10-20% to cover FedRAMP compliance and dedicated infrastructure costs. Mid-market organizations can often access government pricing through GSA Schedule contracts or reseller partners. Contact Qualys for a quote tailored to your organization size and requirements.
Browse All FedRAMP Authorized Tools
Search and filter 80+ FedRAMP authorized products for your defense contracting needs.
Open FedRAMP FinderGet a defensible CUI architecture
This Qualys GovCloud FedRAMP profile flags the gaps. The next step is a compliance architecture review where we map your data flows to FedRAMP-authorized alternatives and CMMC-aligned controls.
Schedule architecture reviewRelated: how much CMMC certification costs — DoD’s own priced figures