What FedRAMP Class A actually gives you
FedRAMP Class A is the first genuinely new entry point to the federal cloud market since FedRAMP launched in 2011. It opened for submissions on August 3, 2026. For SaaS companies with an existing SOC 2 Type II, it changes the calculus on federal market entry completely.
Under the legacy Rev5 process, getting onto the FedRAMP Marketplace required finding a federal agency willing to sponsor you through a 12–24 month authorization process costing $500K–$2M. Most commercial SaaS companies couldn't get that first government relationship without being on the Marketplace — a classic catch-22 that kept the federal market largely closed to new entrants.
Class A breaks that loop. With a qualifying SOC 2 Type II report plus 25 additional mandatory FedRAMP rules (including 7 Key Security Indicators), you get a real FedRAMP Certification listed on the Marketplace — no agency sponsor, no 3PAO assessment, no multi-year slog. The pipeline opened three weeks ago and the Marketplace already shows the first Class A listings.
Class A is a real certification, not a readiness designation. It's easy to confuse Class A with the old "FedRAMP Ready" status, which was a waypoint, not a certification. Class A is an actual FedRAMP Certification class. You appear on the Marketplace as FedRAMP Certified (Class A). Federal agencies can use your service for low-risk pilot deployments. That's meaningfully different from "in process."
Eligibility: does your SOC 2 qualify?
Not every SOC 2 Type II report gets you through the door. FedRAMP's rules under CR26 are specific about what qualifies:
- Type II only. SOC 2 Type I does not qualify. You need an opinion on operating effectiveness over a defined period — not just suitability of design.
- Completed within the past 12 months. The report must be dated within the prior 12 months. A report from 14 months ago won't cut it. If you're close to your annual renewal, time the Class A application to run in parallel with your next audit.
- Cloud security in scope. Your SOC 2 scope must include cloud security controls — not just application-level Trust Services Criteria with no infrastructure coverage. A SOC 2 report scoped only to availability of a hosted app with no cloud configuration controls will have material gaps.
- Complete Security TSC included. The Common Criteria (Security) Trust Services Category is mandatory. SOC 2 reports that only cover Availability or Processing Integrity without the Security TSC will not have the control coverage FedRAMP needs.
Bridge letters matter. If your SOC 2 is 9–11 months old, FedRAMP may require a bridge letter from your auditor confirming that no material changes have occurred to your control environment since the report date. Get ahead of this — bridge letters take time to arrange and need to be included in your submission package.
SOC 2 → FedRAMP Class A crosswalk
Here's the honest picture of what your SOC 2 covers, what it partially covers, and where the gaps are. The good news: the overlap is substantial. Access control, change management, encryption, incident response, and vendor management all map across. The gaps are specific and addressable — mostly around automation requirements and federal-specific documentation.
| Control Area | SOC 2 Coverage | Class A Status | Gap / Note |
|---|---|---|---|
| Access Control | CC6 — logical access, provisioning, access reviews | Partial | SOC 2 accepts manual quarterly reviews. Class A requires automated account management (KSI-IAM-AAM). New tooling or automation needed. |
| Multi-Factor Authentication | CC6.1 — authentication controls | Partial | SOC 2 accepts TOTP, SMS, or push MFA. Class A requires phishing-resistant or passwordless methods (KSI-IAM-APM). FIDO2 / hardware keys or passkeys required. |
| Encryption | CC6.1 — data at rest and in transit | Covers | FedRAMP encryption standards (AES-256, TLS 1.2+) align well with what SOC 2 auditors test for in cloud environments. KSI-SVC-SIN adds a verification requirement — continuous confirmation, not just documentation. |
| Change Management | CC8 — change approval, testing, rollback | Covers | Strong carry-over. KSI-CMT-LMC requires logging and monitoring of changes — check that your CI/CD pipeline produces continuous, machine-readable change logs rather than just ticket records. |
| Incident Response | CC7 — detection, escalation, notification | Covers | Your IR policy and documented procedures satisfy most of KSI-INR-RIR. FedRAMP adds specific incident reporting timelines to the PMO — Initial Incident Report (IIR) within 1 hour, Final Incident Report (FIR) within 5 days. Update your IR plan to include these. |
| Vulnerability Management | CC7.1 — scanning, patching, remediation SLAs | Partial | SOC 2 accepts quarterly scanning with defined SLAs. FedRAMP's vulnerability requirements under CR26 are more prescriptive — N1–N5 severity tiers with specific remediation timelines. Your existing program likely needs SLA updates. |
| Vendor / Supply Chain | CC9 — vendor risk, contracts, assessments | Covers | Good carry-over. FedRAMP also wants automated monitoring of third-party dependencies (KSI-SCR). Software composition analysis tooling (Snyk, Dependabot, etc.) running continuously satisfies this for most providers. |
| Security Training | CC1.4 / CC2.2 — awareness training, completion tracking | Partial | KSI-CED-RAT requires that you regularly review all training for effectiveness — not just track completion. Your existing training program likely needs a documented review cadence and effectiveness assessment, even if the content is solid. |
| Logging and Monitoring | CC7.2 — log collection, SIEM, anomaly detection | Covers | Strong carry-over if your logging covers infrastructure and not just application events. FedRAMP wants continuous monitoring — logs must feed an always-on pipeline, not just be available on request. |
| Asset Inventory | CC6.1 — asset management, system boundary | Partial | FedRAMP's Minimum Assessment Scope (MAS-CSO-IIR) requires you to identify every information resource in scope, including personnel and budget. More comprehensive than a typical SOC 2 asset inventory. Needs expansion. |
| OSCAL Package | Not covered | Gap | SOC 2 produces PDFs. FedRAMP requires machine-readable OSCAL-format submission packages. Your GRC platform needs OSCAL export capability, or you need tooling to produce the JSON schemas FedRAMP specifies. |
| Trust Center | Not covered | Gap | Class A requires a public Trust Center where certification data, KSI evidence, and ongoing monitoring outputs are published for agency review. This is a new infrastructure requirement with no SOC 2 equivalent. |
| FedRAMP Incident Reporting | Not covered | Gap | FedRAMP requires direct reporting of incidents to the FedRAMP Security Inbox within defined timelines. SOC 2 only requires customer notification. Add FedRAMP PMO as a named escalation path in your IR plan. |
The 7 Key Security Indicators required for Class A
Class A requires 7 KSIs from the full FedRAMP 20x set. These are the same KSIs required for Rev5 Class A — they carry forward into any higher class you pursue, so none of this work is wasted. Here's each one, what it actually requires, and honestly where SOC 2 holders stand.
CMT
LMC
Change Management: Continuous Change Logging
All changes to the environment must be logged and that logging must be continuous and machine-readable — not just tracked in a ticketing system. Infrastructure changes, configuration changes, and code deployments need to emit structured logs to a persistent store.
Partial carry-over from SOC 2. Your change management policy and approval process transfer directly. The gap is usually the machine-readable evidence layer — CI/CD pipeline logs, infrastructure-as-code change events, and configuration drift detection running continuously.
CNA
RNT
Cloud-Native Architecture: Network Segmentation and Restriction
Network traffic must be restricted at the boundary and between system components — segmentation, security groups, and firewall rules that limit what can communicate with what. Cloud-native implementations using VPC security groups, network ACLs, and service mesh policies satisfy this.
✓ Good carry-over. SOC 2 CC6.6 covers boundary protection and network controls. If you're running on AWS, Azure, or GCP with properly configured security groups, you're likely most of the way there. Check that controls are continuously validated, not just configured-and-forgotten.
CED
RAT
Cybersecurity Education: Regular Training Effectiveness Review
Security awareness training must be regularly reviewed for effectiveness — not just delivered and tracked for completion. FedRAMP wants documented evidence that someone is evaluating whether the training is working: phishing simulation results, knowledge assessment scores, or structured annual reviews with documented findings.
Partial carry-over. Most SOC 2 training programs track completion well but have no formal effectiveness review. Add a documented annual training effectiveness review process — it doesn't need to be elaborate, but it must exist and be evidenced.
IAM
AAM
Identity and Access Management: Automated Access Controls
Account lifecycle management — provisioning, access changes, and deprovisioning — must be automated, not manual. A quarterly access review spreadsheet reviewed by a human passes SOC 2. FedRAMP expects automated controls: an identity platform (Okta, Azure AD, Google Workspace) that enforces role assignments, triggers deprovisioning on offboarding, and logs every access event continuously.
✗ Most common gap for SOC 2 holders. If your access reviews are manual or your provisioning is ticket-based with no automation, this requires tooling investment. An IDP with SCIM provisioning and automated deprovisioning workflows is the standard implementation path.
IAM
APM
Identity and Access Management: Phishing-Resistant or Passwordless Authentication
Where feasible, passwordless authentication methods must be used. Where not yet feasible, strong passwords paired with phishing-resistant MFA are required. "Phishing-resistant" is specific — TOTP codes, SMS OTP, and push notifications do not qualify. FIDO2 / WebAuthn hardware keys, passkeys, or platform authenticators (Face ID, Windows Hello) are what FedRAMP is looking for.
✗ Second most common gap. Standard TOTP MFA passes SOC 2 but fails here. Evaluate your identity provider's support for FIDO2/WebAuthn and begin rolling out phishing-resistant MFA to privileged users and production system access first, then all users.
INR
RIR
Incident Response: Regular Procedure Review
Incident response procedures must be documented and regularly reviewed for effectiveness. Evidence of post-incident reviews — lessons learned, tabletop exercises, or retrospectives — must exist. The procedures must also include FedRAMP-specific reporting timelines: Initial Incident Report (IIR) to the FedRAMP PMO within 1 hour of discovery; Final Incident Report (FIR) within 5 days of closure.
✓ Strong carry-over from SOC 2 CC7.3–CC7.5. Your existing IR procedures and post-incident review process transfer directly. Add the FedRAMP PMO notification requirements and the 1-hour/5-day timelines to your IR plan. Document one tabletop exercise per year as evidence of regular review.
SVC
SIN
Service Configuration: Encryption and Information Integrity
Information must be secured through encryption and continuous integrity verification. Encryption of data at rest and in transit is required (AES-256 / TLS 1.2+), plus continuous verification that encryption is active and configured correctly — not just a one-time configuration audit. Access to third-party information resources must be restricted and logged.
Partial carry-over. SOC 2 CC6.1 covers your encryption configuration. The FedRAMP addition is continuous validation — automated checks that encryption settings haven't drifted from baseline. Cloud security posture management (CSPM) tools like AWS Security Hub, Microsoft Defender for Cloud, or Orca satisfy this when configured to continuously monitor encryption status.
The two KSIs that require real work: KSI-IAM-AAM (automated account management) and KSI-IAM-APM (phishing-resistant MFA) are where most SOC 2 holders need to invest. Both require tooling changes, not just policy updates. Plan for 4–8 weeks of engineering time to implement automated IDP provisioning and roll out FIDO2/WebAuthn. Everything else in the 7-KSI set is either a direct carry-over or a documentation update.
See Exactly Where Your Gaps Are Before You Start
Our free assessment covers access controls, MFA, logging, change management, and incident response — the exact control areas the 7 Class A KSIs test. Know what you're walking into before you engage FedRAMP.
Start Free AssessmentWhat you need to submit for Class A
The Class A submission package is more involved than "send us your SOC 2 report." FedRAMP's rules under CR26 specify exactly what must be included. Plan for 8–12 weeks of prep to assemble a complete package.
From your SOC 2 report (required documents)
- The complete SOC 2 Type II report — all sections, including the auditor's opinion, description of the system, and results by criterion
- Bridge or gap letter — required if your report is more than 6 months old, signed by your CPA firm confirming no material changes to the control environment
- Verified audit engagement documentation — evidence of the audit engagement: signed engagement letter, auditor firm credentials, audit period confirmation
- Estimated schedule for your next SOC 2 report — FedRAMP wants to know when your next report is planned, since Class A requires a current report to remain valid
- Supplemental compliance evidence — any evidence that fills gaps between your SOC 2 scope and FedRAMP requirements (penetration test results, additional scan reports, policy documents)
New FedRAMP-specific requirements
- OSCAL-formatted certification package — the FedRAMP JSON schemas describing your system and how it meets each Class A rule. Your GRC platform needs OSCAL export, or you'll need tooling to produce this. This is the most technically novel piece of the submission.
- Trust Center — a public-facing page where FedRAMP certification data and KSI evidence are published for agency review. Several compliance platforms now offer managed Trust Center hosting.
- KSI evidence for all 7 required indicators — machine-readable evidence (where automated) or documented process evidence (where process-based) for each of the 7 KSIs above
- Minimum Assessment Scope documentation — an inventory of every information resource in scope: systems, people, and budget. More comprehensive than a standard SOC 2 system description.
- Public information summary — a plain-language public description of your service, its data handling, and its certification status. Published on the Marketplace and Trust Center.
No 3PAO required for Class A. Unlike Class B and C, Class A does not require an independent assessment by a FedRAMP Recognized assessor. The FedRAMP PMO reviews your submission directly. This removes the largest single cost line from the traditional authorization process — third-party assessor fees typically run $100K–$400K for Rev5 audits.
What Class A actually gets you on the Marketplace
This is the question worth answering clearly, because there's nuance here that some vendors gloss over.
What Class A does: Your product appears on the FedRAMP Marketplace in the Preparation phase, listed as FedRAMP Certified (Class A). Federal agencies can see you, evaluate you, and use your service for low-risk pilot deployments. You can truthfully tell federal procurement teams that you are FedRAMP Certified. You appear alongside Class B, C, and D providers in Marketplace search results.
What Class A does not do: It does not qualify your service for broader agency-wide deployments, workloads involving sensitive or controlled unclassified information, or any use case where the agency's own risk determination requires Class B (Low) or higher. Most medium-to-large federal contracts will specify Class C (Moderate) as the minimum. Class A gets you in the door and into pilot conversations — it doesn't close enterprise-scale federal deals on its own.
The realistic use case: Class A is ideal for landing your first federal agency customer through a pilot, establishing a reference customer, and building the internal credibility and revenue to justify the investment in Class B or C. Government pilots often run 6–12 months before expanding — which aligns exactly with the transition timeline you're on anyway.
The Marketplace right now: As of September 2026, the FedRAMP Marketplace shows only 3 Class A listings — the pipeline only opened August 3. Class B has 66 listings and Class C has 474. Getting Class A early means being discoverable before the category fills up. First-mover visibility on the Marketplace matters when agencies are searching for new solutions.
The transition clock: Class A → Class C
Class A is explicitly transitional. FedRAMP's rules are clear: you cannot stay at Class A indefinitely. Here's exactly how the clock works.
Class A Certification obtained
You're on the FedRAMP Marketplace in the Preparation phase. Agencies can use your service for low-risk pilots. The two-year overall window begins.
Day 0First federal agency adopts your service
The 12-month transition clock starts. Once any federal agency begins using your Class A service, you have 12 months to begin your Class B or Class C certification process — meaning you must have an Independent Verification and Validation (IVV) assessment scheduled or underway.
Month 0 of 12-month clockMonth 12 — IVV must be scheduled
You must have a FedRAMP Recognized assessor engaged and your Class B/C IVV scheduled. "Scheduled" means a signed engagement, not an intent to find an assessor. Start your assessor search at month 6 — top-tier 3PAOs with 20x experience are booking 3–4 months out.
12 months after first agency useMonth 24 — Overall Class A window expires
Two years from your Class A certification date, Class A expires regardless of whether you have a federal agency customer. If you haven't obtained Class B or C by this point, your Marketplace listing lapses. Build your roadmap around the 24-month outer boundary even if you haven't landed a federal customer yet.
Hard deadline: 24 months from Class A certClass C (Moderate) Certification
The target for most SaaS companies. Class C replaces the old FedRAMP Moderate designation and qualifies your service for the broadest range of federal agency use cases — including workloads involving sensitive federal data. Everything you built for Class A carries forward: your KSI infrastructure, your OSCAL tooling, your Trust Center.
Target: 12–18 months from Class AWhy most SaaS companies should target Class C, not just Class B
Class B (Low) replaces the legacy FedRAMP Low designation and has 56 KSIs. It's a full certification but limits you to lower-risk, lighter-use federal workloads. Class C (Moderate) has 61 KSIs and is what most federal agency procurement requires for any workload handling government data. The difference between Class B and Class C is 5 additional KSIs and a more rigorous IVV assessment — it's worth going to Class C directly rather than stopping at Class B and needing to upgrade again 12 months later.
The practical path for a commercial SaaS company entering federal: Class A now → Class C within 18 months. Skip Class B unless your target use cases are explicitly limited-risk and you have a compelling reason not to invest in the full Moderate baseline.
Your 90-day Class A prep timeline
Organizations with a mature SOC 2 Type II program can realistically complete Class A preparation in 90–120 days. Here's how to sequence it:
Weeks 1–2: Gap assessment and package planning
- Confirm your SOC 2 report is within 12 months (or plan the bridge letter)
- Run the crosswalk above against your actual control environment — document where you're covered, partial, and gapped
- Assess OSCAL tooling options — check if your GRC platform (Vanta, Drata, Secureframe, Tugboat Logic) supports OSCAL export; if not, evaluate alternatives
- Identify your Trust Center hosting approach
- Assign ownership: who is driving OSCAL, who is driving KSI implementation, who is managing the submission
Weeks 3–8: Close the KSI gaps
- KSI-IAM-AAM: Implement automated IDP provisioning/deprovisioning (Okta SCIM, Azure AD lifecycle workflows, or equivalent). This is the longest lead-time item — start immediately.
- KSI-IAM-APM: Roll out FIDO2/WebAuthn MFA for privileged users and production system access. Okta, Duo, and Microsoft Authenticator all support FIDO2. Start with admins and expand from there.
- KSI-CMT-LMC: Instrument your CI/CD pipeline to emit structured, machine-readable change logs. GitHub Actions, AWS CodePipeline, and similar tools can be configured to produce OSCAL-compatible change records.
- KSI-CED-RAT: Document an annual training effectiveness review process. Add it to your security calendar, run it, document the outcome.
- KSI-SVC-SIN: Configure CSPM (AWS Security Hub, Microsoft Defender for Cloud) to continuously validate encryption settings. Schedule findings for weekly review.
- KSI-INR-RIR: Update your IR plan to include FedRAMP PMO notification timelines. Schedule and document a tabletop exercise.
Weeks 9–12: Build and submit the package
- Generate OSCAL-format FedRAMP JSON schemas for your system description and control mappings
- Launch your Trust Center with KSI evidence and public certification data
- Assemble the complete submission package: SOC 2 report, bridge letter if needed, OSCAL package, MAS documentation, public information summary
- Submit to the FedRAMP PMO and begin Marketplace listing process
Nothing you build for Class A is throwaway. Your OSCAL tooling, KSI automation infrastructure, and Trust Center all carry forward to Class C. The 7 Class A KSIs are a subset of the 61 Class C KSIs. When you move to Class C, you're adding 54 additional KSIs on top of infrastructure you've already built — not starting over. Design your Class A implementation with Class C in mind from day one.
Find Your SOC 2 → FedRAMP Gaps Before You Start
Our free assessment covers the control areas that map to the 7 Class A KSIs — identity management, access controls, logging, change management, and incident response. Know exactly what needs work before you commit to a timeline.
Start Free AssessmentFrequently Asked Questions
Can I use SOC 2 Type II to get FedRAMP certified?
Yes — but only for FedRAMP Class A, and only if your report was completed within the past 12 months. SOC 2 Type II satisfies the Alternative Security Framework requirement and gets you onto the FedRAMP Marketplace in the Preparation phase. You still need to address 25 mandatory FedRAMP rules on top of your report, including 7 Key Security Indicators. SOC 2 alone is not enough — it's the foundation, not the complete package.
What are the 7 KSIs required for FedRAMP Class A?
The 7 required KSIs are: KSI-CMT-LMC (log and monitor changes), KSI-CNA-RNT (restrict network traffic), KSI-CED-RAT (review all training), KSI-IAM-AAM (automate account management), KSI-IAM-APM (adopt passwordless methods), KSI-INR-RIR (review incident response procedures), and KSI-SVC-SIN (secure information). The two that require new investment for most SOC 2 holders are KSI-IAM-AAM and KSI-IAM-APM — automated access controls and phishing-resistant MFA respectively.
Does FedRAMP Class A get you listed on the Marketplace?
Yes. Class A places your product on the FedRAMP Marketplace in the Preparation phase, listed as FedRAMP Certified (Class A). Agencies can see and use your service for low-risk pilot deployments. It does not qualify for broader agency-wide deployments or sensitive data workloads, which require Class C. As of September 2026, there are only 3 Class A listings on the Marketplace — getting in early means real discoverability.
How long do I have to upgrade from Class A to Class B or C?
Two years from your Class A certification date is the outer boundary. Once a federal agency begins using your service, you have 12 months to begin your Class B/C IVV assessment — meaning an assessor must be engaged and an assessment scheduled. Build your roadmap around getting to Class C within 18 months. Start assessor conversations at month 6 — experienced 20x assessors are already booking out 3–4 months.
How much does FedRAMP Class A cost if I already have SOC 2?
Plan for $50K–$150K in preparation costs, primarily engineering time for automated IDP provisioning and phishing-resistant MFA rollout, plus OSCAL tooling and Trust Center infrastructure. There is no 3PAO assessment fee for Class A — that removes the biggest cost line from the traditional process. The 90–120 day prep timeline assumes a well-resourced team with an existing mature SOC 2 program.
What's the difference between FedRAMP Class A and Class C?
Class A uses your existing SOC 2 Type II as the security foundation, requires 7 KSIs, has no 3PAO assessment, and qualifies you for pilot deployments only. Class C (Moderate) requires an independent IVV assessment by a FedRAMP Recognized assessor, requires all 61 KSIs with 70%+ automated validation, and qualifies you for the full range of federal agency workloads including sensitive data. Most serious federal market strategies target Class C — Class A gets you there faster. See our full FedRAMP 20x guide for the complete picture.
Do I need an agency sponsor for FedRAMP Class A?
No — this is one of the most significant changes in the new FedRAMP rules. Class A is processed through Program Certification directly by the FedRAMP PMO. No agency sponsor is required. This is what makes Class A a genuine breakthrough for commercial SaaS companies that previously couldn't get into the federal market without an existing government relationship.