In This Article
Since the FedRAMP 20x Class A pipeline opened on August 3, 2026, the opinions online have split hard. One camp calls Class A the most practical way into the federal market in a decade. The other calls it a marketplace listing with extra paperwork attached.
If you already hold a SOC 2 Type II and you're deciding whether to pursue it, here's the short answer.
Yes, Class A is worth it if you have a current qualifying assessment and you intend to pursue Class B or C. It gets you onto the FedRAMP Marketplace without an agency sponsor or a six-figure bet placed before you've closed a single federal deal. It is not worth it yet if your assessment is more than 12 months old, or if you want a federal badge with no plan to go further.
The rest of this article explains why, what the work involves, and how to tell which side of that line you're on.
What is FedRAMP Class A?
Class A is a FedRAMP 20x certification class for cloud providers that have already completed a recognized security assessment under another framework. You bring that assessment, map it to a defined subset of FedRAMP rules, and publish the results as a machine-readable certification package.
Two conditions come with it:
- Your qualifying assessment (SOC 2 Type II, FedRAMP Rev5 including FedRAMP Ready, or GovRAMP) was completed within the past 12 months.
- You commit to pursuing Class B or Class C within a set timeframe.
Re, the second condition: At a FedRAMP PMO community update, Pete Waterman described the debate behind it. While designing 20x, the team argued about simply granting FedRAMP certification on the strength of an existing SOC 2 or ISO report. They concluded that would never work.
What they could offer was a path. Show your SOC 2 report, show where it maps to the FedRAMP Key Security Indicators (KSIs), and commit to Class B or C. That gets you listed on the Marketplace so you can start selling while you finish the rest.
Class A is an on-ramp with the commitment to go further as part of the deal. The full ruleset is on fedramp.gov.
→ Learn the step-by-step process to achieve Class A
Why do some people say Class A isn't worth it?
The skeptics have real points, and you should hear them before you decide.
Your SOC 2 report won't carry you on its own.
Class A adds a mandatory set of FedRAMP rules on top of your framework.
Some have no counterpart in SOC 2 or GovRAMP: a monitored FedRAMP security inbox, incident reportability evaluation, vulnerability detection, continuous monitoring reports, seven KSIs, and a machine-readable package hosted on a trust center.
FedRAMP itself says providers will need to implement new processes to meet them.
Reviewers won't read your SOC 2 report for you.
"See SOC 2 report" is not an acceptable answer to a FedRAMP rule. Each rule needs a summary detailed enough that a reviewer never has to open your framework materials.
It isn't the finish line.
You're signing up for Class B or C within a set window, so Class A is the first step of a longer program.
Done by hand, it loses its value.
As our founder Kenny puts it, if you don't have a modern way to manage your security package, you'll end up doing everything manually, which defeats the purpose.
Notice that all four points here describe the work. None of them is an argument against doing it, if you're willing to put in the effort. But, before you jump in, it's important you understand the lift.
Why is Class A worth it for most qualifying companies?
The old barrier kept good products out
Before 20x, selling to the government meant betting a few hundred thousand dollars on an authorization and hoping a deal followed.
You also needed an agency willing to sponsor you, which meant that agency had to budget for your product and for an expensive ATO process. Plenty of companies with strong security programs looked at those odds and never tried.
And, boy howdy, do we get it. We got stuck in ATO limbo ourselves for over a year. Agencies were interested, but taking the final leap was a huge ask.
FedRAMP 20x dropped the agency sponsorship requirement. Class A takes it a step further by letting you test federal demand before you fund a full Class B or C effort.
The security work you've already done counts
Kenny learned what happens when it doesn't. In 2016, he was running SOC 2 and ISO 27001 at Adobe across hundreds of service teams. Those teams ran on common controls built around central tools: SailPoint and Okta for identity, Splunk for the SIEM. It worked well enough to win awards.
Then Adobe scoped FedRAMP Moderate. The agency and the PMO ruled out the existing Splunk deployment because it didn't sit in a FedRAMP-authorized data center. Adobe had controls in that data center, and it didn't matter. The team built a separate solution that cost far more, was no more secure, and added compliance burden plus the headcount to carry it.
That's why Kenny is glad Class A exists. As he describes it, a well-run SOC 2 or ISO program and FedRAMP end up asking the same questions:
Class A gives that existing work credit instead of forcing you to rebuild it.
KSI work carries forward
The seven KSIs in the Class A rule set are also required for Rev5 and the other 20x classes. The effort you put into them now feeds directly into Class B or C later.
It's what 20x was built to do
Part of the goal behind 20x is a better process for cloud providers. The larger goal is getting better tools into the hands of government. If you've built something agencies could use, Class A is the most direct path yet to find out whether they want it.
Is Class A worth it for your company?
Watch to learn when Class A is worth your effort.
Take a second look at that ownership row. When teams ask who should run FedRAMP, Kenny's answer is the management team. It shouldn't be an added headcount whose job is collecting evidence and taking screenshots.
Class A brings standing processes, like a monitored security inbox and incident reporting, and those need owners on your org chart — not just words in a package.
What does Class A actually require?
Class A has three layers:
- The assessment you already have
- The FedRAMP rules you add on top
- The Marketplace listing
Layer 1: Your qualifying assessment
Your assessment must be complete and less than 12 months old. FedRAMP offers a Class A self-check if you're unsure.
Layer 2: The FedRAMP rules you add
The bulk of your extra effort is going to be here.
Each rule needs its own summary in your package, written so a reviewer can evaluate it without opening your SOC 2 report.
Layer 3: Getting listed
Using the Marketplace Listing Request Form you can submit your package at any time. It asks for a shared inbox (not one person's email), your company and product names, and a link to the trust center that hosts your package.
If the package is still in progress, you can submit the trust center link and explain the status, which gets you an in-process listing while you finish.
How does Paramify simplify the Class A process?
Kenny boils security down to four parts:
- Risks
- The solutions you put in place
- The capabilities those solutions create
- Validation that they work.
Class A follows the same logic. It asks you to show how your existing controls address FedRAMP's risks, then prove it in a format FedRAMP can read.
Paramify is a risk management platform built around that model. For a Class A push, it handles the parts that turn into manual work everywhere else:
Paramify has been through FedRAMP itself and runs compliance programs for providers including Keeper Security, Qualys, Elastic, and Akamai. Transform9 submitted a complete FedRAMP 20x package in eight days after switching to Paramify. See more results in our case studies, or learn more in What Does Paramify Do?
Move Forward with Class A
For most companies with a current SOC 2 Type II, Legacy FedRAMP Rev5, or GovRAMP assessment and real plans for Class B or C, yes. Class A lets the security program you've already built count toward FedRAMP, gets you on the Marketplace without an agency sponsor, and lets you test federal demand before making the larger investment.
Yes, there's extra effort with: new processes, seven KSIs, and a machine-readable package on a trust center. But, Paramify can map your existing assessment to the Class A rules, build the package, and host it, so the effort goes into security instead of document assembly.
You came here asking whether Class A is worth the effort. For a company that takes security seriously and wants to sell to the government, it's the lowest-cost way in that FedRAMP has offered. If you're still weighing it, or want a second opinion on where your SOC 2 program stands, reach out. We're happy to help you work through it. If you're ready to get started, reach out below to schedule your demo today.
Frequently asked questions
Can I use my SOC 2 Type II to get FedRAMP Class A?
Yes, if the report was completed in the past 12 months. You still need to meet the mandatory FedRAMP rules, including the seven KSIs.
Does ISO 27001 qualify for Class A?
No. The qualifying frameworks are SOC 2 Type II, FedRAMP Rev5 (including FedRAMP Ready), and GovRAMP. ISO 27001 controls can still support your summaries for the added FedRAMP rules.
Do I need an agency sponsor?
No. FedRAMP 20x removed the agency sponsorship requirement that defined the legacy Rev5 process.
Can I point reviewers to my SOC 2 report?
No. Each FedRAMP rule needs a summary detailed enough to stand on its own.
Is Class A permanent?
No. Class A comes with a commitment to pursue Class B or C within a set timeframe.
When can I start?
Now. The Marketplace Listing Request Form has been open since July 6, 2026, and completed Class A certifications have been eligible for the Marketplace since August 3, 2026.
.svg)
.svg)
