From your SOC 2 to FedRAMP Class A: What counts, what FedRAMP adds, and what happens in what order

If your organization already holds a SOC 2 Type II, FedRAMP Class A raises a practical question: how much of that existing work counts? Class A, FedRAMP’s entry-level 20x certification, accepts a SOC 2 Type II as a starting point. The report is only part of the package.

This post walks through what counts from your SOC 2, what FedRAMP adds, and what happens in what order.

Who this is for

This overview is for cloud service providers that hold a SOC 2 Type II and are looking at FedRAMP Class A, and for the security, compliance, and leadership teams mapping out what the Class A package involves.

The short version

• A SOC 2 Type II completed within the past 12 months counts as a starting point.
• FedRAMP also asks for things a SOC 2 does not cover. That means 23 mandatory rules, including the 7 Key Security Indicators (KSIs).
• The cloud service provider applies directly, and the package has to show current status.
• A Class B, C, or D assessment must be scheduled within 2 years of your initial Marketplace listing.

What is FedRAMP Class A?

Class A is the entry class. It is a pilot, limited to low-risk use while the cloud service provider works toward Class B, C, or D.

That direction is built into the rules. A Class B, C, or D assessment must be scheduled within 2 years of your initial Marketplace listing, or FedRAMP removes the listing.

A SOC 2 report and a Class A certification are different things

A SOC 2 is an attestation report; Class A ends in a certification.

What counts from your SOC 2

FedRAMP uses your SOC 2 materials as the foundation and asks for:

• The complete report
• A bridge or gap letter, if one applies
• Documentation verifying the audit engagement
• The date your next report is expected
• Any supplemental evidence, if applicable

Check your dates

The SOC 2 must be completed within the past 12 months. If time has passed since your report period ended, include a bridge or gap letter, if one applies.

What FedRAMP adds

Class A also requires the following, which a SOC 2 does not cover.

Seven Key Security Indicators (KSIs)

The seven KSIs are part of the 23 mandatory rules. They cover logging changes, restricting network traffic, reviewing all training, automating account management, adopting passwordless methods, reviewing incident response procedures, and securing information (KSI-CMT-LMC, KSI-CNA-RNT, KSI-CED-RAT, KSI-IAM-AAM, KSI-IAM-APM, KSI-INR-RIR, KSI-SVC-SIN). A SOC 2 can be supporting evidence, but each KSI still has to be addressed in the package.

A FedRAMP security inbox and a Trust Center

The security inbox is an email address FedRAMP can reach you at. The Trust Center is a website where you share your security information. Basic service information is public; the full package is access-controlled.

The Trust Center shows up at several points in the Class A process:

• The Marketplace listing request includes a Trust Center link.
• The package is hosted on your own Trust Center, not uploaded.
• The public commitment to quarterly progress updates can live on your Trust Center or website.

How you find vulnerabilities and handle incidents

Class A also covers how you find vulnerabilities and how you evaluate and report incidents.

Regular reports after certification

Class A requires an Ongoing Certification Report every 3 months, plus a published next-report date. The package must include a real or example report. The quarterly review meeting is optional for Class A.

A package FedRAMP’s systems can read

The package is made of JSON files that match FedRAMP’s formats, not only a PDF. In plain terms, it is data FedRAMP’s systems can read, not only a document. You host it on your own Trust Center and give FedRAMP the Trust Center URL and JSON schema URL; it is not uploaded.

A Certification Package Overview

The Certification Package Overview describes your offering and its scope. It has nine required components, including information resources in scope, information flows, third-party resources, and cryptographic module documentation.

A public commitment to quarterly progress updates

Class A requires a public commitment, on your Trust Center or website, to give quarterly progress updates.

Some of these rules have no SOC 2 counterpart and may require new processes. FedRAMP also lists 11 recommended and 9 optional rules.

The order of operations

The steps follow a set order, starting with a Marketplace listing and ending with FedRAMP’s review.

1. Get listed on the FedRAMP Marketplace before you apply. Submit the listing request (public information, Trust Center link, and JSON artifacts) and wait for approval.
2. Pull the package together: your SOC 2 materials plus the items above. Address all 23 mandatory rules, including a real or example Ongoing Certification Report.
3. Verify and validate that the package reflects your offering’s current state, within the 7 days before you submit.
4. Apply directly. A third party, including an independent assessor, cannot apply for you.
5. FedRAMP reviews your submission, with a current target of 30 calendar days. No agency sponsor is needed.

You stay responsible for the accuracy of everything in the package, including anything a third party supplies.

FedRAMP Class A at a glance

A SOC 2 Type II is a starting point for FedRAMP Class A: the complete report, documentation verifying the audit engagement, and the dates that come with it. Class A adds 23 mandatory rules, including the seven KSIs, along with a security inbox, a Trust Center, a package FedRAMP’s systems can read, and regular reports after certification. Some of these rules have no SOC 2 counterpart. And the steps follow a set order, from Marketplace listing to FedRAMP’s review.

Questions about FedRAMP 20x? Book a conversation with our team.