FedRAMP has published helpful self-checks for FedRAMP 20x. They spell out what belongs in a certification package and what your Security Decision Record (SDR) has to show, with one checklist for Class A and one for Classes B & C.
Here we’ll summarize the self-check requirements for all 3 certification classes. These checks matter because FedRAMP verifies your Trust Center and package materials before your request enters the Review Queue.
Fast Trust Center access and a complete package mean faster entry. Let’s get into it.
Terms to Know:
If you’re new here, we love acronyms. Love love love. Here are some you’ll need to know and a few helpful links to learn more about these exciting terms.
- CPO: Certification Package Overview.
- SDR: Security Decision Record. It records the implementation status of FedRAMP Practices (Rules and Key Security Indicators) for your cloud service.
- KSI: Key Security Indicator.
- ASF: Alternative Security Framework, such as SOC 2.
- SCG: Secure Configuration Guide.
- IV&V: Independent Verification and Validation.
- Force: whether a rule is a MUST, SHOULD, or MAY.
Requirements that apply to every class
-
1
Trust Center access
FedRAMP must be able to reach every file from your Trust Center without signing an NDA or agreeing to terms of service or conditions. GSA federal personnel don't sign vendor-specific NDAs to access security information submitted for review.
-
2
Schemas in two formats
Every FedRAMP schema that a rule references, such as the SDR or the Ongoing Certification Report (OCR), must be presented in machine-readable and human-readable versions. If the activity hasn't happened yet, such as an incident or an OCR, provide samples.
-
3
All applicable rules in scope
Address every rule that applies to your class. MUST and SHOULD rules both count, even when the status is Not Implemented or Partially Implemented. Check FedRAMP's Force of the Rule page for what each level means.
-
4
MAY rules are a bonus
If you've already done the work for a MAY rule that could apply, include it and take the credit.
-
5
Accurate status on every rule and KSI
Mark each one Implemented, Partially Implemented, or Not Implemented. For the last two, explain why and include your plans with timeframes.
-
6
Room to exceed the minimum
FedRAMP sets the floor. Add anything that gives reviewers useful context.
Class A
Class A certification package
-
1
Alternative Security Framework materials
Such as a SOC 2 Type II report, bridge letter, or RAR.
-
2
Certification Package Overview (CPO)
-
3
Security Decision Record (SDR)
-
4
Referenced artifacts
-
5
Sample schemas
For the applicable rules (listed below).
-
6
Anything else that adds context or value
-
Optional
IV&V
If a FedRAMP-recognized Independent Assessment Service performed IV&V specifically for this Class A certification, add an Assessment Summary under each rule and KSI in the SDR, and an Overall Summary of Assessment in the CPO.
Class A sample schemas
Class A sample schemas
| Schema | Rule ID | Force |
|---|
| Initial Incident Report | IEC-CSO-IIR | SHOULD |
| Ongoing Incident Report | IEC-CSO-OIR | SHOULD |
| Final Incident Report | IEC-CSO-FIR | MUST |
| Historical VER Activity | VER-TFR-MRH | MAY (if the rule is included in your SDR) |
| Ongoing Certification Report | CCM-OCR-AVL | MUST |
Class A SDR completeness
-
1
All Class A rules in scope. MUST and SHOULD rules are both required, even if Not or Partially Implemented. The Class A Ruleset Reference shows which rules apply. Consider adding any MAY rules you already meet.
-
2
An ASF mapping, an artifact, or both on each rule and KSI. A mapping should be direct, like page 2, section 3, table 1 or CC8.1, and never just "See SOC report." An artifact can be a webpage link, an email address, or a policy document. Link it directly or make it easy to find.
-
3
An implementation status on each rule and KSI. It must be accurate. For Partially or Not Implemented, explain why and include future plans with timeframes.
-
4
If you did IV&V, include the Independent Assessor's Assessment Summary for each rule and KSI.
FedRAMP's Class A tips
- Be clear and concise. The goal is a risk-based decision, not confusion.
- A Class A package isn't meant to be a heavy lift. If it feels too hard, you may be overthinking it.
- Run your JSON through FedRAMP's JSON Schema Validator.
- The easier it is to find information and reach artifacts, such as through links, the faster the review.
- FedRAMP reviews everything you include, so anything that doesn't add value slows the process. File size earns no extra points.
- New to Class A? FedRAMP points to its September 20x Community Update, where providers who completed Class A certification talk about the process.
Classes B and C
Class B and C certification package
-
1
Certification Package Overview (CPO)
Rule FRC-CSO-PKG
-
2
Security Decision Record (SDR)
Rule SDR-CSO-FRR
-
3
Secure Configuration Guide (SCG)
Rule SCG-CSO-RSC
-
4
Referenced artifacts and evidence
-
5
Sample schemas
For the applicable rules (listed below).
-
6
Assessment Summary
Under each rule and KSI in the SDR. Rule IVV-IAS-SUM
-
7
Overall Summary of Assessment
Included in the CPO. Rule IVV-IAS-OSA
-
8
Anything else that adds context or value
Class B and C sample schemas
Class B and Class C sample schemas
| Schema | Rule ID | Class B force | Class C force |
|---|
| Ongoing Certification Report | CCM-OCR-AVL | MUST | MUST |
| Initial Incident Report | IEC-CSO-IIR | MUST | MUST |
| Ongoing Incident Report | IEC-CSO-OIR | MUST | MUST |
| Final Incident Report | IEC-CSO-FIR | MUST | MUST |
| Significant Change Notification | SCN-CSO-INF | MUST | MUST |
| Accepted Vulnerability Info | VER-RPT-AVI | MUST | MUST |
| Historical VER Activity | VER-TFR-MRH | SHOULD | SHOULD |
| Vulnerability Detail Report | VER-RPT-VDT | MUST | MUST |
Class B and C SDR completeness
-
1
All rules for your class in scope. MUST and SHOULD rules are both required, even if Not or Partially Implemented. The Class B and Class C Ruleset References show which rules apply. Consider adding any MAY rules you already meet.
-
2
An implementation status on each rule and KSI. It must be accurate. For Partially or Not Implemented, explain why and include future plans with timeframes.
-
3
The Independent Assessor's Assessment Summary for each rule and KSI.
-
4
Historical KSI Metrics, rule FRC-CSX-MOT. This is a SHOULD for Class B and a MUST for Class C.
-
5
Automated verification and validation of rules, rule FRC-CSX-VVR. This is a SHOULD.
FedRAMP's Class B and C tips
- Be clear and concise. The goal is a risk-based decision, not confusion.
- Run your JSON through the JSON Schema Validator.
- The easier it is to find information and reach artifacts, the faster the review.
- Everything you include gets reviewed, and file size earns no extra points.
Class A, B, and C compared
FedRAMP 20x self-check requirements by class
| Requirement | Class A | Class B | Class C |
|---|
| Alternative Security Framework materials (SOC 2 Type II report, bridge letter, RAR) | Yes | Not listed | Not listed |
| Certification Package Overview (CPO) | Yes | Yes | Yes |
| Security Decision Record (SDR) | Yes | Yes | Yes |
| Secure Configuration Guide (SCG) | Not listed | Yes | Yes |
| Referenced artifacts | Yes | Yes, plus evidence | Yes, plus evidence |
| Sample schemas listed | 5 | 8 | 8 |
| ASF mapping, artifact, or both on each rule and KSI | Yes | Not listed | Not listed |
| Accurate implementation status on each rule and KSI | Yes | Yes | Yes |
| Assessment Summary on each rule and KSI | Only if IV&V was performed | Yes | Yes |
| Overall Summary of Assessment in the CPO | Only if IV&V was performed | Yes | Yes |
| Historical KSI Metrics (FRC-CSX-MOT) | Not listed | SHOULD | MUST |
| Automated verification and validation of rules (FRC-CSX-VVR) | Not listed | SHOULD | SHOULD |
"Not listed" means the item doesn't appear on that class's self-check. It doesn't mean the item can't apply to you, so confirm against the ruleset reference for your class.
The checklists separate Class B from Class C in one place: Historical KSI Metrics, a SHOULD for B and a MUST for C. The rulesets behind each class differ, so check which rules apply to you.
Keep up with changing requirements with Paramify
FedRAMP updated both self-checks on October 7, 2026. Each one points to ruleset references, schemas, and rule IDs that FedRAMP maintains. Whoever owns your package has to know which rules apply to your class, how each rule's force reads today, and whether a schema changed since you last built against it.
You can do that yourself. Subscribe to GSA's FedRAMP updates, watch the ruleset reference for your class, and validate your JSON before you submit.
Paramify tracks FedRAMP's requirements for you and changes as they're published, so the rules you're measured against stay current and your team isn't watching help-center pages for edits. Paramify also covers the work around the package, including evidence collection, a Trust Center, and continuous monitoring. The value is greatest for Classes B and C, where the package has more parts, an assessor's summary on every rule and KSI, and Historical KSI Metrics that become a MUST at Class C.
STAY UP TO DATE
Tacks FedRAMP requirements with Paramify
Get a demo
Next steps for your FedRAMP package
The 20x self-checks give you a clear list of what FedRAMP looks for at each class. Check your package against it before you submit, and check again when the requirements change. If you want to see how Paramify tracks those changes, request a demo below.
.svg)
.svg)
%20the%20requirements%20and%20who%20needs%20it.webp)
