How to Get FedRAMP 20x Certified

FedRAMP covers cloud services used by federal agencies. Its Initial Implementation listing rules name two cases: direct use, where agency customers use the product themselves, and indirect use, where the product is a third-party resource inside a cloud offering that agencies use directly. A SaaS vendor whose customer is a federal contractor's cloud product can fall into the second case.

FedRAMP does not list offerings outside its statutory scope, and it says tools used only for other compliance regimes, such as CMMC, do not qualify. A company that sells only to the private sector, or only to state and local government, does not need FedRAMP; state and local buyers often look to GovRAMP instead.

If you are unsure, the useful question is not "should we get FedRAMP" but "which agency, or which agency-facing product, will use our service, and for what." The answer shapes the class.

FedRAMP 20x certifies offerings directly through FedRAMP (the Program path) at three classes today. The descriptions are FedRAMP's, from its 20x page and certification rules.

Class A. For cloud services with mature security programs entering the federal market. It needs a certification under another framework completed in the past 12 months: FedRAMP Rev5 (including FedRAMP Ready), SOC 2 Type II, or GovRAMP. It requires a short mandatory list of rules, including a subset of KSIs, and limited ongoing reporting. A fresh independent assessment is optional.

Class B (formerly Low). For common small-scale or light-use services, where an entire agency is unlikely to use the service for important work. Requires a fresh independent assessment; at least one automated validation method per KSI is recommended.

Class C (formerly Moderate). For common enterprise services likely used across an agency, or that provide important government services. Requires a fresh independent assessment and at least two automated validation methods per KSI.

Class D (formerly High) is not yet available through 20x; FedRAMP estimates a pilot in FY27 Q1–Q2.

Rev5 remains open for new applications until 11 June 2027. You cannot pursue a Rev5 Program Certification and a 20x Program Certification for the same offering. The FedRAMP 20x vs. Rev5 guide compares the two.

A questionnaire, this guide included, cannot tell you which class you qualify for. That depends on how agencies will use the service and on FedRAMP's rules for each class.

Under FedRAMP's Initial Implementation listing rules, every provider must hold an Initial Implementation Phase Marketplace Listing before it can apply for certification. To get one you show that the offering fits direct or indirect agency use and publish basic public information about it. You request the listing through FedRAMP's Marketplace Provider Listing Request Form; FedRAMP does not accept listing applications by email.

The listing carries obligations. You must document progress toward certification on your website or trust center, measured against your own goals and milestones, at least quarterly. Within two years of listing you must show that a Class B, C or D assessment is scheduled, or FedRAMP removes the listing until you can.

One more rule from the start: providers must apply for certification themselves. FedRAMP's rules say a provider must not use a third party, including an independent assessment service, to apply on its behalf.

FedRAMP certifies a cloud service offering, which it defines as "a specific, packaged cloud computing product or service supplied by a cloud service provider for use by customers." Not the company, and not every product it sells.

Write down exactly what that offering is: which product or edition, which environment and regions, which features are in and which are out. Then list what it depends on: the infrastructure it runs on, identity, email, logging and monitoring, support tooling, and any other third-party service that handles agency data or controls access to it. For each dependency, find out whether it holds its own FedRAMP certification and how FedRAMP's rules treat it for your class.

Some providers choose a separate government environment rather than certifying their commercial one. That is a business decision as much as a technical one, and it is easier to make before the boundary is documented than after.

Key Security Indicators are how FedRAMP 20x states its security requirements. Each is an outcome to achieve and keep achieving, grouped in families such as Identity and Access Management, Change Management, Cloud Native Architecture, Service Configuration, Incident Response and Cybersecurity Education. Examples from the Class A list: KSI-IAM-AAM, "Automating Account Management"; KSI-CNA-RNT, "Restricting Network Traffic"; KSI-CED-RAT, "Reviewing All Training". Class A uses a subset; Classes B and C use more.

The Security Decision Record replaces the traditional System Security Plan. FedRAMP's SDR rules require it in both human-readable and JSON form, with, for each applicable rule, how you follow it or why you do not, plus its verification and validation. For 20x it also summarises how each KSI is measured and how often. Historical metrics are optional at Class A, recommended at Class B, and required at Class C, including 30-day summaries and daily metric data.

Continuous validation is the point of 20x. FedRAMP's stated principle is that security should be "continuously enforced, monitored, and reported—not staged for a point-in-time audit." In practice that means validating each KSI automatically where you can, at least two methods per KSI at Class C, and keeping the results in a machine-readable form. An initial certification package must have been verified and validated within the previous seven days.

If your evidence today lives in screenshots and annual audit binders, this is usually the largest piece of work.

FedRAMP's definitions separate two roles.

An assessor performs assessment, verification or validation activities for a cloud service offering. For FedRAMP, that is an independent assessment service FedRAMP has recognized ("FedRAMP Recognized"). Classes B, C and D need a fresh independent assessment completed in the three months before submission; for Class A it is optional. Recognized assessors are listed at fedramp.gov/marketplace/assessors.

An advisor is "an entity that helps a provider understand, prepare for, or maintain FedRAMP Certification." Advisors that meet FedRAMP's listing rules appear at fedramp.gov/marketplace/advisors, filterable by the highest class they have advised on.

The two jobs are different, and the assessor's independence is the reason the assessment means anything. Neither can apply for certification on your behalf. Choose either on your own due diligence; a listing is FedRAMP's directory, not a recommendation from this site.

Scoping the company instead of the offering. Certification attaches to one cloud service offering. Decide which one first.

Working from pre-2026 guidance. FedRAMP Ready stopped accepting submissions on 28 July 2026, the JAB path has been replaced, and 20x does not use an agency sponsor. Much of what is published online predates the Consolidated Rules for 2026.

Treating SOC 2 as FedRAMP. A recent SOC 2 Type II is one way to meet the Class A prerequisite. It is not a FedRAMP certification, and it does not substitute for the KSIs.

Picking a class before knowing the use. The class follows from how agencies will use the service. Start with the customer, then the class.

Evidence that cannot be validated automatically. 20x expects validation that runs continuously, not documents assembled for an audit.

Letting the listing lapse. Initial Implementation requires public progress updates at least quarterly and a scheduled Class B, C or D assessment within two years.

Expecting someone else to apply. Providers apply directly. Advisors can help you prepare; they cannot submit for you.

1. Get a starting checklist. The free FedRAMP 20x Readiness Explorer asks a few questions about your service and security program and gives you the next steps to research, with links to the rules behind each one. No account, no email required. It is informational guidance, not an official readiness assessment.

2. Read the rules for your likely class. Start with FedRAMP's Consolidated Rules for 2026 and the timeline.

3. Write down the offering's boundary and dependencies. One page is enough to start.

4. Inventory your evidence. For each KSI in your likely class, note what you can validate automatically today and what you cannot.

5. Talk to assessors and, if you want help, advisors. Use FedRAMP's assessor and advisor directories.

ThirdProof is not a FedRAMP assessor or advisor and does not offer certification services. Facts on this page were checked against fedramp.gov in October 2026; where they disagree, fedramp.gov is right.