Pragma is the vehicle.

Customers reach FedRAMP authorization through the Pragma engagement. The authorization attaches to their system — never to us. We never claim to be FedRAMP-authorized, FedRAMP-certified, or a FedRAMP service provider, because none of those describe what Pragma is.

What Pragma actually claims

  • OKDocumentation engineering for regulated software.
  • OKYour SSP is an engineering artifact.
  • OKWe rebuild FedRAMP documentation as OSCAL — versioned, diff-able, continuously evaluated against your codebase.
  • OKWe help SaaS vendors achieve FedRAMP authorization faster.
  • OKUsed by SaaS vendors In Process for FedRAMP authorization.

What Pragma will never claim

  • NO“Pragma is FedRAMP authorized.” Pragma the firm is not authorized; only customer SaaS systems are.
  • NO“Pragma is a FedRAMP service provider.” Same problem — implies an authorization that doesn’t exist.
  • NO“FedRAMP-certified documentation engineering.” There is no FedRAMP certification for a documentation firm.
  • NO“We are an authorized 3PAO.” We are not. We partner with 3PAOs; they assess, we engineer.
  • NO“Pragma owns a FedRAMP authorization.” Authorizations attach to systems, not vendors.

Why we’re explicit about this

  1. Legal exposure. Claiming an authorization that doesn’t exist is misleading commercial speech, potentially actionable under the Lanham Act and FTC consumer-protection rules.
  2. Federal-procurement risk. Federal buyers verify FedRAMP status against the FedRAMP Marketplace. A claim that doesn’t show up there is an instant disqualifier.
  3. Portfolio discipline. Every Wentzel product applies the same wording test: only describe capabilities the product actually has. Pragma is no exception.

Pragma’s own posture

Pragma the firm is SOC 2 Aligned. CARL self-attestation runs on every PR, and the badge in the footer reflects the current self-attested maturity level. When prospects ask “Are you FedRAMP-authorized?”, the answer is — no, we help our customers get there.

Source-of-truth governance lives on PRAG/03 in Confluence. Marketing copy, sales emails, blog posts, and press releases are all reviewed against the same rule before they ship.