SOC 2 to FedRAMP 20x Class A: The Step-by-Step Guide

Yes. A SOC 2 Type II completed within the past 12 months is the main eligibility requirement for FedRAMP 20x Class A. Your SOC 2 report is the entry ticket, not the whole package.

Beyond the core Class A rules, FedRAMP requires 24 more mandatory rules. They include 7 Key Security Indicators (KSIs), a FedRAMP-compatible trust center, a monitored Security Inbox, incident reporting, vulnerability detection, quarterly Ongoing Certification Reports and a machine-readable JSON package. You also need a public Marketplace listing before you apply. Your SOC 2 evidence covers much of the underlying security work. It does not cover the federal-specific process rules.

Class A is a starting point. FedRAMP expects your Class B, C or D assessment to be scheduled within 2 years of your initial listing, or the listing comes down.

Last verified against FedRAMP CR26 rules v2026.11.02.01 on Nov 4, 2026.

New to Class A? Start with our explainer, FedRAMP Class A: How SOC 2 Holders Can Enter the Federal Market. This guide picks up where that one stops: the how-to, the evidence and the free templates.

Key facts at a glance

Free downloads (no form)

• Class A project plan: phases, owners and exit criteria
• SOC 2 to Class A crosswalk: every mandatory, recommended and optional rule mapped to typical SOC 2 evidence
• Class A evidence checklist
• Policy addenda pack for the federal-specific rules
• Certification Package JSON guide

What is FedRAMP 20x Class A, and what isn't it?

FedRAMP 20x Class A is the entry-level FedRAMP Certification under the FedRAMP Consolidated Rules for 2026 (CR26). It lets a commercial cloud service with an external security assessment, such as a SOC 2 Type II report, get listed and certified on the FedRAMP Marketplace without building a government-only version.

FedRAMP itself says that providers entering the federal market should, in most situations, start with Class A. The 20x path runs through Program Certification, which means FedRAMP processes your application directly. You do not need an agency contract or sponsor first.

Here is what Class A is not:

• It is not a Low, Moderate or High authorization. FedRAMP says Classes signal assurance and do not map one-to-one to impact levels.
• It is not reciprocity. FedRAMP's notice on CR26 says no reciprocity from external frameworks "is intended or will be granted."
• It is not permanent. FedRAMP describes Class A as "intended to be transitory".
• It is not a CMMC shortcut. Services used only to meet CMMC requirements are out of scope, and FedRAMP says it does not "support or provide 'equivalency.'"

FedRAMP's presumption of adequacy for Class A is narrow on purpose: pilots, configuration and testing, or "extremely low or negligible risk use cases such as processing public information or getting started with very few users." That matters for sales. Class A gets you in front of agencies, but most production use will need Class B or C.

If you are deciding between frameworks rather than planning the work, read FedRAMP vs. SOC 2. To see where your service will likely land after Class A, see FedRAMP 20x Class B vs. Class C.

Are you eligible for Class A? A 5-minute check

Under rule FRC-CLA-ASF, you need one of these, completed within the past 12 months:

• A SOC 2 Type II report
• A FedRAMP Rev5 or FedRAMP Ready assessment
• A GovRAMP assessment

A SOC 2 Type 1 report does not qualify. Type 1 tests design at a point in time, and FedRAMP names Type II.

Then run this check before you spend any money:

1. Was your SOC 2 Type II completed within the past 12 months, and will it still be when you apply? FedRAMP's rule doesn't say whether that runs from the report date or the end of the audit period, so if you're close, plan on your next report. Our guide to SOC 2 bridge letters explains what they cover and what they don't.
2. Does the SOC 2 scope match the service you want listed? Same product, same environments, same regions. A report that covers your core app but not the data pipeline agencies will use is a scope gap.
3. Will an agency use the service directly, or indirectly inside another government-wide cloud service? That is the scope FedRAMP serves. If the only driver is a defense contractor's CMMC requirement, start with CMMC vs. FedRAMP instead.
4. Can you publish what FedRAMP requires? That means a public Marketplace listing, a public progress page updated at least quarterly, and public certification data in human-readable and JSON form.
5. Is someone on your team accountable? FedRAMP accepts help from advisors and tools, but the provider stays accountable (FRC-CSO-MRA), and third parties cannot apply on your behalf (FRC-APP-NTP).

If you pass all five, you are a Class A candidate. If you are not sure whether you need FedRAMP at all, see who needs FedRAMP.

What carries over from SOC 2, and what doesn't?

Your SOC 2 report carries over as the foundation. FedRAMP lists your complete report as required material (FRC-CLA-EAM), along with any bridge or gap letter, verified audit engagement documents, an estimated schedule for your next report, and supplemental evidence where needed.

What carries over well:

• Access control, MFA and offboarding evidence
• Change management and deployment approvals
• Incident response plans and post-incident reviews
• Vulnerability scanning and penetration test results
• Logging, monitoring and alerting
• Vendor management and risk assessment

What doesn't carry over:

• A FedRAMP Marketplace listing and public progress updates
• A FedRAMP-compatible trust center with programmatic access and access logs
• A FedRAMP Security Inbox that FedRAMP can reach without a CAPTCHA or portal
• Federal incident reporting with FedRAMP's timeframes
• Ongoing Certification Reports every 3 months, with a published next report date
• The Certification Package in JSON

Expect your policies to need addenda, not rewrites. In one recent client mapping, none of the existing policies fully covered the Class A mandatory rules before addenda. SOC 2 policies are written for an auditor's criteria, not for FedRAMP's named process rules.

FedRAMP is also direct about how to use your report. Its guidance for the mandatory rules says "just saying 'see SOC 2 report' is not particularly helpful". Each rule needs its own explanation and evidence.

For the SOC 2 control background, see our SOC 2 controls list.

Which 7 KSIs does Class A require, and how does SOC 2 evidence map?

Class A requires 7 of the 46 KSIs in CR26. FedRAMP requires them even if you plan to move to a Rev5 path later. Under SDR-CSX-KSI, each KSI needs a summary in your Security Decision Record explaining how you meet it.

For the full KSI model, see what the FedRAMP 20x KSIs are and KSIs vs. NIST controls. The table below is the Class A subset only.

The KSI names and statements are condensed from FedRAMP's Class A KSI page. Read each full statement there before you write your summaries. Note the word "persistently" in several of them: FedRAMP wants ongoing review, not an annual check.

Which process rules are new for SOC 2 teams?

These are the rules most SOC 2 programs have never had to meet. They are where Class A work concentrates.

Marketplace listing and progress page

You must be listed on the FedRAMP Marketplace before you apply (FRC-APP-MLF). FedRAMP takes listing requests through its form, not by email. Once listed, you must show continuous progress on your trust center or website, updated at least quarterly (MKT-IIP-DCP). FedRAMP calls this "a marketing and customer experience challenge", so treat it as a public page your sales team will point to.

Security Inbox

You need a FedRAMP Security Inbox that FedRAMP can always reach. Use a role address rather than a personal one, and make sure no CAPTCHA, ticket portal or auto-filter blocks FedRAMP messages. FedRAMP's rules say you must receive and react to its messages without disruption, and complete the required actions in Emergency messages within the timeframe each message sets (AFC-CSO-INB, AFC-CSO-RCV, AFC-CSO-CRA).

Incident reporting

At Class A, a Final Incident Report is mandatory (IEC-CSO-FIR). FedRAMP's timeframe table sets it at 3 business days for every incident rating. Initial and ongoing incident reports are recommended rather than mandatory at Class A. Plan for them anyway. They become mandatory at Class B and above, and agency customers will expect them.

Vulnerability detection

FedRAMP's VDR rules page says vulnerability detection is "NOT limited to traditional vulnerability scanning". Penetration tests, a vulnerability disclosure program and bug bounty findings all count as sources. So does an out-of-date statement in your own Security Decision Record. FedRAMP treats that as a vulnerability. FedRAMP's recommended VDR-TFR timing rules for Class A include monthly verification of machine-based resources. For how pentests fit, see SOC 2 penetration testing.

Ongoing Certification Reports

You must publish an Ongoing Certification Report every 3 months (CCM-OCR-AVL) and publish the date of the next one (CCM-OCR-NRD).

Continued independent assessment

At Class A, you must keep meeting the expectations of your underlying framework (IVV-CSX-AIA). In practice, that means keeping your SOC 2 audit cycle current. A lapsed SOC 2 report undercuts your Class A certification.

Choosing your certification type

You must state one Program Certification type (FRC-CSO-POP). For most SaaS on FedRAMP Certified infrastructure, that is 20x. See FedRAMP 20x vs. Rev5 for the tradeoffs.

What goes in the Class A Certification Package?

The Certification Package replaces the traditional System Security Plan. Under FRC-CSO-PKG, it has three parts:

1. Cloud Provider Overview (CPO). This describes the service, its boundary and how agencies use it.
2. Security Decision Record (SDR). For each rule, it explains how the rule is followed, or why it does not apply, along with the evidence. Each of the 7 KSIs also needs its summary under SDR-CSX-KSI.
3. Ongoing Certification Report (OCR). Include a real one or an example of the one you will publish every 3 months.

Format rules:

• Certification data must be available as JSON, with CORS enabled, a Content-Type of application/json and nosniff set (FRC-CSO-JSN).
• FedRAMP publishes the JSON schemas, dated June 24, 2026, and a validator at fedramp.gov.
• CR26 packages use FedRAMP's own JSON schemas. OSCAL isn't required for a Class A package. Our earlier post on FedRAMP 20x and OSCAL covers the background.
• The package you submit must show the current state of the service as verified and validated by you within the previous 7 days (FRC-APP-FCP).

Keep it lean. Write one explanation per rule, link to evidence, and avoid pasting whole policies. If an SDR statement goes stale, it becomes a vulnerability under VDR-CSO-DET, so every sentence you publish is something you have to maintain.

Does your trust center meet FedRAMP's requirements?

You need a FedRAMP-compatible trust center (CDS-CSO-UTC). Most SOC 2 trust pages are built for sales and NDA-gated document requests. FedRAMP asks for more.

A FedRAMP-compatible trust center must:

• Give agencies access without a manual approval each time (CDS-TRC-USH)
• Offer programmatic access to certification data, including human-readable files (CDS-TRC-PAC)
• Keep an inventory of agency access (CDS-TRC-AAI)
• Log access and keep summaries for at least 6 months (CDS-TRC-ACL)

You must also publish 16 public fields about your service in human-readable and JSON form (CDS-CSO-PUB), keep sensitive information out of them (CDS-CSO-RIS), and notify FedRAMP within 5 business days if you deny an agency's access request (CDS-UTC-AAD).

Do not assume your current trust center vendor already meets these rules. Ask them to show you each one: programmatic access, access inventory and 6-month access logs. If you are building a trust page from scratch, see building trust with a company trust page.

How do you go from SOC 2 to Class A, step by step?

Here is the sequence we use. Each phase has an exit test. Do not start the next phase until it passes.

Phase 0: Eligibility and scope

• Confirm your SOC 2 Type II report date and the date of the next one
• Confirm the SOC 2 scope matches the service you want listed
• Confirm agency use, direct or indirect
• Name an accountable owner and a backup
• Pick your certification type (20x for most)

Exit test: you can state the listed service, its boundary and its eligibility basis in one paragraph.

Phase 1: Gap assessment

• Map all 24 mandatory rules, 10 recommended and 9 optional rules to your current evidence (download the crosswalk)
• Test each of the 7 KSIs against the "gap to test" column above
• Review the trust center against the 4 compatibility rules
• List the policies that need addenda

Exit test: every mandatory rule is marked met, partial or not met, with an owner and a fix.

Phase 2: Build and fix

• Set up the Security Inbox and test that FedRAMP-style messages get through
• Write policy addenda for incident reporting, vulnerability detection, ongoing reports and the inbox (download the policy addenda template)
• Close KSI gaps, such as automating deprovisioning or tightening outbound network rules
• Configure the trust center for programmatic access and access logging
• Collect evidence against the checklist (download the evidence checklist)

Exit test: every mandatory rule is met, with evidence you can link.

Phase 3: Package, listing and application

• Submit the Marketplace listing request and publish your progress page
• Write the CPO and SDR, including the 7 KSI summaries
• Produce the JSON and validate it against FedRAMP's schemas (download the package JSON guide)
• Re-verify the package so it is no more than 7 days old when you apply
• Submit the application form yourself (FRC-APP-AFC)

Exit test: the package validates, the listing is live and the application is submitted.

Ongoing: Operate the certification

• Publish an Ongoing Certification Report every 3 months, plus the next report date
• Update the public progress page at least quarterly
• Keep SDR statements current
• File Final Incident Reports within FedRAMP's timeframe
• Keep your SOC 2 audit cycle on schedule
• Track the 2-year clock to a Class B, C or D assessment

The full plan, with owners and exit criteria, is in the Class A project plan.

Scope traps to avoid

• Listing a service your SOC 2 report doesn't fully cover
• Leaving out a subprocessor or region that federal data will touch
• Forgetting backups, logs and analytics stores when mapping KSI-SVC-SIN
• Using a personal address or ticket portal as the Security Inbox
• Treating the progress page as a one-time post
• Writing SDR statements you can't keep current
• Assuming a sales-gated trust page counts as FedRAMP-compatible

How long does SOC 2 to Class A take?

It depends mostly on four things: how current your SOC 2 report is, how closely its scope matches the listed service, how many KSI gaps you have, and whether your trust center already supports programmatic access and logging.

What FedRAMP's own record shows is that the review side can move fast. The Class A pipeline opened Aug 3, 2026. FedRAMP granted the first Class A certification on Aug 25, 2026. FedRAMP does not publish a standard review time, so treat that as one data point rather than a promise.

Your readiness work is the larger variable. The phases above are sequential, and the fastest teams are the ones whose SOC 2 scope already matches the service they want listed.

If your SOC 2 report is near the 12-month line, plan around your audit calendar first. If you don't have a SOC 2 Type II yet, Class A has to wait until the observation period and report are complete.

For the wider 20x timeline, see how long FedRAMP 20x takes. For budgeting, see FedRAMP 20x cost.

What happens after Class A?

The clock starts at your initial listing. Under MKT-IIP-DLA, a Class B, C or D assessment must be scheduled within 2 years of initial listing in the Initial Implementation Phase. If it isn't, FedRAMP removes the listing until one is scheduled. FedRAMP extended this window from 1 year to 2 years in its March 2026 notice.

Agencies have their own guidance: they "should not authorize a FedRAMP Class A Certified service for more than 12 months unless the provider is seeking a Class B, C, or D Certification." So if you have agency customers, show progress toward the next class well before the 2-year mark.

There is no bridge. FedRAMP says it "is not providing a bridge from external frameworks to other classes of FedRAMP Certification." Class B and C require more:

• Every 20x Class B and C provider must include all KSIs in a FedRAMP independent assessment at least once a year (IVV-CSX-AIA)
• Historical KSI metrics in the SDR are recommended at Class B and required at Class C (SDR-CSX-KMT)
• Validated cryptography is optional at Classes A and B and recommended at Class C (CMU-CSO-UVM)

The work you do for Class A still counts. Your inbox, incident reporting, trust center, JSON package and KSI evidence all carry forward. You can also move from 20x Class A to a Rev5 Class B, C or D through Agency Certification if an agency sponsors you. FedRAMP stops accepting applications for new Rev5 certifications on June 11, 2027. Existing Rev5 certifications remain active until at least December 31, 2028, unless FedRAMP is otherwise directed.

For the next step, see FedRAMP 20x Class B vs. Class C and the FedRAMP 20x roadmap.

Frequently asked questions

Can I use a SOC 2 Type 1 report for Class A?

No. FedRAMP names SOC 2 Type II. A Type 1 report tests design at a point in time, not operating effectiveness over a period.

Do I need a FedRAMP Recognized independent assessment service for Class A?

No. At Class A, having your Certification Package independently verified and validated by a FedRAMP Recognized independent assessment service before you submit it is optional (FRC-CLA-IVV). FedRAMP has moved away from the historical term "3PAO". You still need your SOC 2 audit to stay current.

Do I need an agency sponsor?

No. 20x Class A uses Program Certification, so FedRAMP reviews your application directly.

Can a consultant apply for us?

No. Third parties can help you prepare, but the provider must submit its own application and remains accountable for it.

Does Class A count for CMMC?

No. Services used only to meet CMMC requirements are out of scope for FedRAMP, and FedRAMP does not provide equivalency. Questions about CMMC go to the Department of War.

Is Class A the same as FedRAMP Low?

No. Classes indicate assurance, not impact level, and FedRAMP says they do not map one-to-one. Class A is presumed adequate for pilots, testing and very low-risk uses.

What if our SOC 2 report expires while we're certified?

You must keep meeting your underlying framework's expectations, so plan your next SOC 2 audit and bridge letters on a schedule that never leaves a gap. FedRAMP asks for your estimated next report date up front.

Do the CR26 rules change?

Yes. FedRAMP versions the rules and updates them. Two Class A rule lists changed on Oct 31, 2026. Check the change log below and the rule pages before you submit.

Get a SOC 2 → FedRAMP Class A gap check

Workstreet will map your SOC 2 report and current evidence against all 24 mandatory Class A rules and the 7 KSIs. You get a list of gaps, owners and fixes. You keep accountability for the application, as FedRAMP requires. We help you get ready for it.

Get a SOC 2 → FedRAMP Class A gap check

Change log - Nov 4, 2026: Published. Verified against FedRAMP CR26 rules v2026.11.02.01. - Oct 31, 2026 (FedRAMP change): SDR-CSX-KSI added to the Class A mandatory rules. CPO-CSF-CPM removed from the recommended rules. - Oct 5, 2026 (FedRAMP change): JSON delivery (FRC-CSO-JSN) and public certification data (CDS-CSO-PUB) rules clarified.