FedRAMP 20x Class A explained: eligibility, requirements, and next steps

For cloud service providers (CSPs), the traditional FedRAMP Rev. 5 Agency Certification path requires an agency sponsor, an independent assessment, and a substantial documentation package.

FedRAMP 20x adds a second route: Program Certification. Under this path, FedRAMP certifies the provider directly, so a federal agency sponsor is not required. See how the two paths compare.

Class A is the entry-level Program Certification. To qualify, a provider must have completed a certification or equivalent assessment from an approved framework within the previous 12 months. The Class A pipeline opened on August 3, 2026, shortly after FedRAMP Ready moved to legacy status on July 28. Providers with a recently completed Readiness Assessment Report (RAR) may still be able to use it to support a Class A submission. See FedRAMP’s update.

Below, we cover who qualifies, how Class A works, how it compares to the Rev. 5 path, and how to prepare.

What is FedRAMP 20x Class A?

FedRAMP describes Class A as an entry-level certification for cloud services that already run mature security and compliance programs. Maturity alone isn’t enough to qualify, though. The formal test is a recent assessment from an approved framework.

Class A reflects FedRAMP 20x’s broader shift away from long narrative documents and toward demonstrated security outcomes and structured evidence. Providers still submit a complete Certification Package. That package includes information about the service and, for each relevant rule, how the provider implements it, validates it, and has had it assessed. Parts of the package must also be machine-readable, which we cover below. See the full Class A rules.

Who qualifies for FedRAMP 20x Class A?

To be eligible, a provider must have completed a certification or equivalent assessment within the previous 12 months under one of these frameworks:

• FedRAMP Rev. 5, including FedRAMP Ready, at any historical impact level
• SOC 2 Type II
• GovRAMP, at any impact level

What a provider submits depends on which framework it used, based on the external assessment materials rule:

• SOC 2 Type II: the complete report, any applicable bridge or gap letter, verified audit-engagement documentation, an estimated schedule for the next report, and supplemental compliance evidence where applicable.
• FedRAMP Ready and GovRAMP: the RAR, the Security Assessment Plan (SAP), and any other materials the relevant program requires.

These materials supplement the Class A Certification Package; they don’t replace it. Providers still have to address every mandatory Class A rule and include the associated artifacts or an information mapping. Some rules have no equivalent in external frameworks, and a blanket reference such as “see SOC 2” won’t satisfy them. Review the full Class A rule set.

How does Class A work?

Compared with the Rev. 5 path, Class A puts more weight on evidence that demonstrates security outcomes. Providers still need to explain their implementation, validation, and assessment decisions in the Certification Package.

The requirements fall into four areas: the seven Class A Key Security Indicators, machine-readable information where the rules call for it, ongoing reporting and assessment, and trust-center use.

1. Key Security Indicators: Demonstrating measurable outcomes

Class A applicants must address seven Key Security Indicators (KSIs):

• Reviewing All Training
• Logging Changes
• Restricting Network Traffic
• Automating Account Management
• Adopting Passwordless Methods
• Reviewing Incident Response Procedures
• Securing Information

Providers must map supporting evidence to each indicator in the Certification Package. View the Class A KSI definitions. Vulnerability detection is a separate mandatory Class A rule, not one of the seven KSIs.

Good to know: Class A requires seven of the 46 indicators in the full FedRAMP 20x KSI set. Those seven are one part of a wider Class A rule package, which also covers certification data, trust-center use, reporting, incidents, and vulnerabilities. 

2. Machine-readable evidence: Making security information easier to validate

Machine-readable requirements are rule-specific. When a FedRAMP rule includes a JSON schema, providers must supply valid JSON unless the rule states otherwise. Class A also requires certain public service information in both human-readable and JSON formats. This doesn’t mean every artifact or evidence item must be machine-readable.  See FedRAMP’s package and JSON rules.

Monitoring and compliance systems may already hold useful source data. Teams still need to confirm that each required item is complete, uses the prescribed format, and is accessible to the parties FedRAMP identifies.

3. Ongoing requirements: Maintaining evidence

Class A obligations continue after the initial assessment. Providers must:

• Submit an Ongoing Certification Report every three months
• Make the next report date public
• Meet applicable incident, vulnerability, and independent-verification requirements

See the mandatory Class A rules.

Evidence management becomes part of normal operations. Assign clear owners for updating Certification Data, preparing reports, and responding when evidence surfaces an incident, vulnerability, or compliance gap.

4. Trust centers: Sharing Certification Data

Providers must use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data with all necessary parties. That makes the trust center more than a sales asset. It becomes the system through which agencies and other stakeholders access a provider’s certification information, and it must meet FedRAMP’s published compatibility requirements. See the Use Trust Centers rule.

Class A certification doesn’t settle every agency’s security or procurement questions. Each agency still decides whether a certified service fits its mission and requirements.

How to prepare for Class A: a checklist

Use this checklist to compare your current evidence and processes against the mandatory Class A rules.

1. Review the full Class A rules. Identify which rules apply to your service and what the Certification Package needs to include.
2. Map evidence to every applicable rule. Include the seven KSIs, record gaps, and note where you need FedRAMP-specific evidence. An existing commercial assessment won’t automatically satisfy every Class A requirement.
3. Check the required JSON. Validate machine-readable information against each applicable FedRAMP schema, and confirm that public information is available in human-readable and JSON formats where required.
4. Assign owners for ongoing requirements. Set responsibility for the three-month reports, incident evaluation, vulnerability detection, and keeping Certification Data current.
5. Confirm your trust center. Make sure it meets FedRAMP’s compatibility requirements and that all necessary parties can access your Certification Data through it.
6. Plan for the next class. Consider your service’s intended federal use and what Class B or higher would require.

Planning should go beyond the initial certification

Class A gives eligible CSPs a defined 20x path built on a recent qualifying assessment and the mandatory Class A rules. Before applying, confirm your assessment is eligible, map the full rule set, and set up the reporting and trust-center processes your service will need.

Responsive Trust Center helps teams centralize certifications, policies, and answers, and control how they share that information with stakeholders. See the Responsive Trust Center overview.