FedRAMP vs. SOC 2: What Cloud Service Providers Need to Know

FedRAMP and SOC 2 are both security frameworks, but they serve different purposes.

SOC 2 is mostly commercial. It's what enterprise buyers expect to see as part of procurement, whereas FedRAMP is for federal compliance. So when it comes to FedRAMP vs. SOC 2, it's never really an either/or question. In this guide, we'll be focusing on the differences between the two frameworks and how much of your SOC 2 work carries over towards FedRAMP.

What's the Difference Between FedRAMP and SOC 2?

Both frameworks ask you to protect customer data, but in reality, they diverge a lot more than they align. SOC 2 is a voluntary attestation and reporting framework for commercial businesses. Often, it's pursued as a business moves upmarket and begins selling to enterprise buyers, as it's the gold standard in North America and gives procurement teams confidence in your systems and your ability to handle sensitive information.

FedRAMP is a U.S. government program for assessing and certifying cloud service providers (CSPs). Its goal is to establish that each provider in the federal marketplace meets NIST SP 800-53 security requirements around how its systems are configured, operated, and continuously monitored. If you're a CSP that wants its products or services to be used by federal agencies covered by FedRAMP, meeting FedRAMP requirements isn't optional.

What Does a SOC 2 Report Prove?

SOC 2: An attestation from an accredited CPA firm covering how your organization protects customer data.

An auditor reviews your controls and issues an opinion about them, which means there's no certificate and no pass or fail. After your SOC 2 audit, you'll receive a report. An unqualified SOC 2 means the auditor found no exceptions, and this is what your sales team will want to shout about during procurement. A qualified report means the auditor found one or more issues with your security controls.

SOC 2 isn't a prescriptive framework, so there's significant flexibility in how an organization meets its requirements. Instead of a set of controls you must implement, SOC 2 defines criteria your security posture needs to address. It's then up to your organization to design and implement controls to meet those criteria.

The auditor then evaluates whether your controls are appropriately designed and implemented to meet the criteria. This means that two companies can receive an unqualified SOC 2 while having very different security postures.

The audit itself comes in two forms. A Type 1 evaluates whether your controls are designed appropriately at a single point in time, and a Type 2 evaluates whether they operated effectively across a window, with 90 days as the minimum for a first audit.

What Does a FedRAMP Certification Prove?

FedRAMP is the U.S. government's program for authorizing cloud services to handle federal data. If you want to sell cloud services to a federal agency, FedRAMP is the only route into the marketplace.

The FedRAMP requirements come from NIST SP 800-53, and under the new FedRAMP 20x requirements, controls are now met via Key Security Indicators (KSIs). Each KSI sits on top of a group of underlying controls, sometimes a handful, sometimes twenty or so, and you choose how to meet the indicator. Evidence must also be machine-readable and shared continuously. With 20x, FedRAMP's goal is to automate validation for more than 80% of requirements.

FedRAMP 20x also removes the need for an agency sponsor to start the process, opening up the federal marketplace to many more organizations.

The 20x certification pipelines opened to the public over the summer, with Class A in August and Classes B and C at the end of the same month.

How FedRAMP and SOC 2 Compare

Why FedRAMP Is a Larger Commitment Than SOC 2

SOC 2 is often a business decision made because your customers need to have confidence in your security posture before they sign a deal. Like any security framework, it requires engineering time and work to be done writing policies and building processes.

FedRAMP is potentially a business-altering decision. It's something you do because you intentionally want to open up your business to the federal marketplace.

FedRAMP 20x is generally a much bigger investment than SOC 2, taking up more time, engineering work, and cash.

When you begin working towards FedRAMP certification, you're not just implementing controls, you're also building a system that can continuously prove compliance via machine-readable evidence. The NIST controls FedRAMP is built on are also a more prescriptive and demanding baseline than SOC 2 as well.

How FedRAMP Class A Opens Up FedRAMP to SOC 2 Holders

Class A is FedRAMP's new entry-level certification. It lets you list in the federal Marketplace using a SOC 2 Type 2, without an agency sponsor.

One of the main goals of FedRAMP 20x is to get more innovative businesses into the federal market, and during the 20x pilots, FedRAMP found that companies starting out with commercial frameworks like SOC 2 were still essentially starting from scratch when it came to FedRAMP certification. So it built Class A as a bridge to encourage more CSPs into the FedRAMP Marketplace.

Class A is designed for pilot programs, configuration and testing, and for negligible-risk use. It's not something that'll win your business huge federal agency contracts.

To apply, you need one of the following: a SOC 2 Type 2, GovRAMP at any impact level, or an existing FedRAMP Rev 5 or FedRAMP Ready designation.

A SOC 2 Type 2 report gets you to the starting point, but Class A layers in some additional FedRAMP-specific requirements on top of your existing certification, which will take significant work for most commercial CSPs to meet.

Class A also comes with a clock. Within two years of your Marketplace listing going live, you have to have a FedRAMP assessment for a Class B, C, or D certification scheduled, or your Marketplace listing will be removed.

What Carries Over From SOC 2 to FedRAMP?

It's hard to say exactly how much of your SOC 2 work carries over to FedRAMP. Generally, policies covering access control, change management, encryption, incident response, and vendor management map across fairly well. And if you use modern cloud tooling like AWS, Datadog, a compliance platform like Vanta, and centralized logging, that'll carry over too.

What's missing, and a lot of work to implement, is the controls required to meet the NIST SP 800-53 requirements and the mapping that connects those requirements to FedRAMP 20x's KSIs.

Even if you're aiming for Class A to begin with, FedRAMP adds 23 mandatory rules on top of SOC 2, with 11 recommended and 9 optional rules. In its documentation, FedRAMP also notes that some of these rules "may not have similar counterparts in external frameworks and providers will need to implement new processes to follow these rules."

Adding FedRAMP Class A on top of your SOC 2 is a very different challenge from adding a commercial framework like ISO 27001, where many of the controls map over. FedRAMP is much more prescriptive, and due to the types of data FedRAMP-certified organizations handle, it has a more demanding security baseline too.

For more on how SOC 2 maps to FedRAMP, check out our SOC 2 to FedRAMP mapping guide.

Do You Need FedRAMP, SOC 2, or Both?

For most cloud-based companies, SOC 2 is the answer and FedRAMP isn't a question yet. Opening up the U.S. government and federal agencies as potential buyers is what makes FedRAMP worth doing.

If there are no federal or SLED (State, Local, and Education) opportunities in your pipeline, and you don't plan on expanding into that market anytime soon, you should stay with SOC 2. A FedRAMP certification won't make you more attractive to commercial buyers.

If you see the federal market as a huge expansion opportunity, which, honestly, I think it is for many cloud-native startups out there, then FedRAMP 20x is at least worth discussing internally, especially with the Class A ramp opening up.

If you're already bidding on work that specifies Class B or C, then go straight at the full certification.

If you're selling to the Department of War, you'll need a different path entirely, and CMMC is likely your framework.

One thing I want to be explicit about: FedRAMP doesn't replace SOC 2. A commercial buyer likely won't care if you have FedRAMP Class A, B, C, or D if they want to see a SOC 2 report.

Beyond that, I'd treat the decision like any other market opportunity. Look at the market size, what entry costs you, and the commercial opportunity it presents, then decide whether you have conviction based on that. The public sector is a large segment and a huge market opportunity, and FedRAMP 20x makes it cheaper and faster to pursue.

The Federal Marketplace Is Opening Up to More CSPs

Innovative startups and CSPs have typically been shut out of the federal marketplace. The costs and timeline required to achieve traditional FedRAMP Rev 5 authorization were often prohibitive, with timelines spanning 12 to 18 months and costs running at least $500K and frequently $1M+. Under Rev 5, an agency sponsor was also required to even start the authorization process.

Now, FedRAMP 20x changes things. Certification is designed to be much faster, and it costs far less than it did under Rev 5. 20x also removes the agency sponsor requirement. And every week I'm having conversations with commercial businesses that are thinking about the federal market as their next big expansion opportunity. I'm convinced that every growth-stage business should at least evaluate the opportunity.

At Workstreet, we offer expert-led FedRAMP 20x implementation. If you're interested in learning more about FedRAMP 20x and what it'd take to get your business certified, talk to our team.