Core service · Government & Defense · FedRAMP 20x, Classes A to D
Issued by
GSA / FedRAMP
Typical timeline
Varies by class
Assessed by
Independent assessor
Validity
Ongoing, with persistent validation
Overview
Who needs FedRAMP 20x?
- 01Cloud providers pursuing FedRAMP certification under the 2026 rules
- 02SaaS companies with a recent SOC 2 Type II, FedRAMP Rev5 or GovRAMP certification (the Class A route)
- 03Teams that would rather prove security with automation than with narrative documents
What it proves
That a cloud service meets FedRAMP's security outcomes, shown through Key Security Indicators and automated, machine-readable evidence.
Asked for by
Federal agencies choosing cloud services from the FedRAMP Marketplace.
Requirements
What the auditor looks for.
- 01Class ABuilds on a certification from an approved framework in the past 12 months: FedRAMP Rev5 (including FedRAMP Ready), SOC 2 Type II or GovRAMP. A fresh independent assessment is optional.
- 02Class BA fresh independent assessment, and at least one automated method for each Key Security Indicator.
- 03Class CA fresh independent assessment, and at least two automated methods for each Key Security Indicator.
- 04Class DA fresh independent assessment, and at least four automated methods for each Key Security Indicator. Class D is currently being piloted.
- 05Key Security Indicators (KSIs)Measurable statements of security capability across ten themes, from identity and access management to supply chain risk, each with its own measures, automation and history.
- 06Security Decision Record (SDR)For every applicable rule and KSI: how it is met, and how that was verified and validated, independently too. Supplied in human-readable form and as JSON that validates against FedRAMP's schema.
Our approach
How we get you FedRAMP 20x-ready.
What you get
What you walk away with.
- 01Class recommendation (A to D)
- 02KSI mapping
- 03Automated validation plan
- 04Security Decision Record (Word)
- 05SDR in JSON, schema-validated
- 06Assessor coordination
FAQ
Questions, answered.
FedRAMP's path to certification under its Consolidated Rules for 2026. Instead of long narrative control descriptions, you show security through Key Security Indicators, backed by automated evidence and a Security Decision Record.
It depends on what you already hold and what you can automate. Class A builds on a recent FedRAMP Rev5, SOC 2 Type II or GovRAMP certification. Classes B, C and D need a fresh independent assessment and progressively more automated validation for each KSI. We recommend a class in the first two weeks.
The Security Decision Record documents how you meet each applicable rule and KSI, and how that was verified and validated. FedRAMP requires it in human-readable form and as JSON that validates against its schema, so we deliver both: a Word document for people and JSON for systems.
The Consolidated Rules for 2026 launched on June 24, 2026. Providers can obtain initial certification under them from July 4, 2026, and must maintain ongoing certification under them from January 1, 2027.
FedRAMP, based on an independent assessment. We are your readiness partner: we prepare your KSIs and SDR package and coordinate with the assessor. We never perform the assessment ourselves.
Typical timeline: varies by class, depending on scope, maturity and team availability. We'll give you a firm plan after a two-week scoping and gap assessment.
Yes, that's our specialty. FedRAMP 20x shares substantial control overlap with FedRAMP and GovRAMP, so we build one control set and map evidence across all of them.
Next framework
FedRAMP
End of the thread
A 30-minute call with a senior practitioner. You leave with a plan either way.
We handle audit readiness and auditor coordination. Your SOC reports and ISO certificates are always issued by independent, accredited auditors.