{ "$schema": "https://sequencerassurance.com/schemas/services-menu.schema.json", "info": { "title": "Sequencer Assurance Services Menu", "description": "The catalog of compliance and assurance services offered by Sequencer Assurance, structured for both people and agents.", "version": "1.0.0", "last_updated": "2026-10-25", "default_currency": "USD", "provider": { "name": "Sequencer Assurance", "url": "https://sequencerassurance.com" }, "sources": { "fedramp-rules": { "title": "FedRAMP Consolidated Rules for 2026", "version": "2026.10.13.01", "url": "https://github.com/FedRAMP/rules", "data_url": "https://raw.githubusercontent.com/FedRAMP/rules/main/fedramp-consolidated-rules.json" } } }, "categories": { "fedramp": { "title": "FedRAMP End-to-End Implementation", "description": "Services that take a cloud service offering to, and keep it at, a FedRAMP Certification." } }, "services": { "SVC-FED-CLA": { "slug": "fedramp-class-a", "profile": { "type": "20x", "paths": [ "Program" ], "class": "A" }, "title": "FedRAMP 20x Class A Certification", "tagline": "Turn your SOC 2, GovRAMP, or FedRAMP Ready assessment into a FedRAMP Class A Certification.", "description": "Sequencer Assurance takes a cloud service offering that already holds a recent SOC 2 Type II, GovRAMP, or FedRAMP Rev5 assessment and prepares everything FedRAMP requires for a 20x Class A Certification: scope, Marketplace listing, the FedRAMP-specific operational processes, the seven required Key Security Indicators, and a schema-valid certification package ready for the client to submit.", "category": "fedramp", "status": "active", "audience": { "for": [ "Cloud service offerings sold, or about to be sold, to US federal agencies directly or as a component of another cloud service offering", "Cloud service offerings with a SOC 2 Type II, GovRAMP, or FedRAMP Rev5 assessment completed in the last 12 months" ], "not_for": [ "Cloud service offerings whose only government use is meeting other compliance programs such as CMMC", "Cloud service offerings that need a Rev5 Program Certification or an agency-sponsored path", "Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP 20x Class B, C, or D certification" ] }, "eligibility": [ { "requirement": "A certification or equivalent from SOC 2 Type II, GovRAMP (any impact level), or FedRAMP Rev5 / FedRAMP Ready (any impact level), completed within the past 12 months.", "blocking": true, "source_refs": [ "FRC-CLA-ASF" ] }, { "requirement": "A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly.", "blocking": true, "source_refs": [ "MKT-IIP-AGU", "MKT-FRP-SOF" ] }, { "requirement": "Not concurrently seeking a FedRAMP Rev5 Program Certification for the same cloud service offering.", "blocking": true, "source_refs": [ "FRC-CSO-POP" ] } ], "outcomes": [ "A FedRAMP Marketplace listing with public human-readable and JSON information about the cloud service offering", "A complete, schema-valid 20x Class A certification package, freshly validated and ready to submit", "A Security Decision Record that addresses every MUST and SHOULD Class A rule and Key Security Indicator with an accurate implementation status, a direct alternative framework mapping or linked artifact, and timeframed plans for anything not yet fully implemented", "Package files FedRAMP can open from the trust center without an NDA or terms of service, so the package clears FedRAMP's pre-queue verification and enters the Review Queue sooner", "Running FedRAMP processes: security inbox, incident reporting, vulnerability detection, and quarterly Ongoing Certification Reports", "A plan toward Class B, C, or D, since agencies should not use a Class A cloud service offering for more than 12 months without one" ], "timeline": { "summary": "About 2 to 5 weeks from kickoff to a submitted application, depending on how many FedRAMP-specific processes already exist. Marketplace listing runs alongside the operational build-out.", "total": { "min": 2, "max": 5, "unit": "weeks", "estimate": true, "note": "Critical path through the phases, rounded up to whole weeks; build.py checks it." }, "client_effort": { "min": 5, "max": 10, "unit": "hours", "estimate": true, "note": "Spread across the 2 to 5 weeks." }, "footnote": "Estimates cover Sequencer Assurance and client work only. Time for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by FedRAMP or GSA.", "phases": { "readiness": { "order": 1, "title": "Eligibility and gap assessment", "description": "Confirm the alternative framework assessment qualifies and is inside its 12-month window, define the assessment scope, and measure the gap against every mandatory Class A rule.", "duration": { "min": 1, "max": 7, "unit": "days" }, "owner": "sequencer-assurance", "deliverables": [ "gap-report" ] }, "marketplace": { "order": 2, "title": "Marketplace listing", "description": "Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing.", "duration": { "min": 1, "max": 1, "unit": "days" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "public-info" ] }, "operations": { "order": 3, "title": "FedRAMP operational build-out", "description": "Stand up the FedRAMP security inbox, incident reportability and final reporting, vulnerability detection, the trust center, the quarterly report process, and evidence for the seven required Key Security Indicators.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "runbooks", "ocr-template" ] }, "package": { "order": 4, "title": "Certification package authoring", "description": "Write the Certification Package Overview and Security Decision Record in human-readable and JSON form, validate them against FedRAMP's schemas, and confirm public JSON is served with correct CORS and headers.", "duration": { "min": 1, "max": 7, "unit": "days" }, "depends_on": [ "operations", "marketplace" ], "owner": "sequencer-assurance", "deliverables": [ "certification-package", "sample-reports" ] }, "submission": { "order": 5, "title": "Final validation and client submission", "description": "Re-verify the package against the live cloud service offering, then the client submits the FedRAMP Certification Application. FedRAMP does not accept third-party applications, so Sequencer Assurance prepares the package and the client submits it.", "duration": { "min": 1, "max": 7, "unit": "days" }, "depends_on": [ "package" ], "owner": "client", "deliverables": [ "submission-kit" ] }, "fedramp-review": { "order": 6, "title": "FedRAMP review", "description": "FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review.", "duration": { "min": null, "max": null, "unit": "weeks", "note": "Set by FedRAMP; not published in the rules dataset." }, "depends_on": [ "submission" ], "owner": "fedramp" } }, "clocks": [ { "name": "Alternative framework freshness", "description": "The SOC 2, GovRAMP, or FedRAMP Rev5 assessment must have been completed within the past 12 months at application.", "window": { "min": null, "max": 12, "unit": "months", "estimate": false }, "source_refs": [ "FRC-CLA-ASF" ] }, { "name": "Package freshness", "description": "The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days.", "window": { "min": null, "max": 7, "unit": "days", "estimate": false }, "source_refs": [ "FRC-APP-FCP" ] }, { "name": "Class A agency use window", "description": "Agencies should not use a Class A cloud service offering for more than 12 months unless it is actively seeking Class B, C, or D.", "window": { "min": null, "max": 12, "unit": "months", "estimate": false }, "source_refs": [ "AGU-USE-CLA" ] } ] }, "deliverables": { "gap-report": { "title": "Class A gap report", "description": "Status of each mandatory, recommended, and optional Class A rule against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record.", "formats": [ "PDF", "JSON" ], "source_refs": [ "FRC-CLA-MFR", "FRC-CLA-RFR", "FRC-CLA-OFR" ] }, "public-info": { "title": "Public cloud service offering information", "description": "Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report date.", "formats": [ "HTML", "JSON" ], "source_refs": [ "CDS-CSO-PUB", "CCM-OCR-NRD", "FRC-CSO-JSN" ] }, "runbooks": { "title": "FedRAMP operating runbooks", "description": "Procedures for the FedRAMP security inbox, emergency actions, incident reportability, final incident reports, and vulnerability detection.", "formats": [ "Markdown", "PDF" ], "source_refs": [ "AFC-CSO-INB", "AFC-CSO-RCV", "AFC-CSO-CRA", "IEC-CSO-EFR", "IEC-CSO-FIR", "VDR-CSO-DET" ] }, "ocr-template": { "title": "Ongoing Certification Report template and example", "description": "A quarterly report template plus a filled example for the package.", "formats": [ "PDF", "JSON" ], "source_refs": [ "CCM-OCR-AVL" ] }, "certification-package": { "title": "Certification package", "description": "Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class A rule and Key Security Indicator. Each entry carries an implementation status, a direct alternative framework mapping (a specific criterion such as CC8.1, or a page and section, never just the report as a whole) or a linked artifact, and, where partially or not implemented, the reason and a plan with timeframes. Includes the alternative framework materials (such as the SOC 2 Type II report and bridge letter) and every referenced artifact, all reachable from the trust center without an NDA or terms of service, plus the independent assessor's summaries when the client opts for independent verification and validation.", "formats": [ "HTML", "JSON" ], "source_refs": [ "FRC-CSO-PKG", "FRC-CLA-EAM", "CPO-CSO-OVR", "SDR-CSO-FRR" ] }, "sample-reports": { "title": "Sample incident and vulnerability reports", "description": "Filled samples of the Initial, Ongoing, and Final Incident Reports, plus historical vulnerability detection and response activity when that rule is in the Security Decision Record, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident has occurred.", "formats": [ "HTML", "JSON" ], "source_refs": [ "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "VER-TFR-MRH" ] }, "submission-kit": { "title": "Submission kit", "description": "Final validation record and a pre-filled guide for the client's FedRAMP Certification Application Form.", "formats": [ "PDF" ], "source_refs": [ "FRC-APP-FCP", "FRC-APP-AFC", "FRC-APP-NTP" ] } }, "cost": { "model": "tiered", "currency": "USD", "price": { "min": 15000, "max": 20000 }, "display": "$15,000 flat with the client's trust center, or $20,000 with a Sequencer Assurance trust center MVP", "tiers": { "client-trust-center": { "title": "Client trust center", "description": "The client brings an existing FedRAMP-compatible trust center.", "price": { "min": 15000, "max": 15000 }, "includes": [ "The full fixed-scope Class A engagement" ], "source_refs": [ "CDS-CSO-UTC" ] }, "trust-center-mvp": { "title": "Trust center MVP", "description": "Sequencer Assurance provides a trust center MVP that meets the Class A requirements.", "price": { "min": 20000, "max": 20000 }, "includes": [ "The full fixed-scope Class A engagement", "A trust center MVP provided by Sequencer Assurance" ], "source_refs": [ "CDS-CSO-UTC", "CDS-CSO-PUB" ] } }, "add_ons": [ { "title": "GRC tools from the client's maturity roadmap", "description": "Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee.", "pricing": "quoted", "requires_client_approval": true } ], "billing": [ { "milestone": "Kickoff", "percent": 50 }, { "milestone": "Package ready for submission", "percent": 50 } ], "third_party_costs": [ "Alternative framework audits (SOC 2, GovRAMP)", "Licensing for the client's own trust center (client trust center tier)", "Optional FedRAMP Recognized independent assessor" ] }, "inclusions": [ "Gap assessment against all 23 mandatory Class A rules and indicators, plus the recommended rules the Security Decision Record must also address and the optional rules the client already meets", "Authoring of the certification package and public JSON in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator", "Direct alternative framework mappings and linked artifacts for every rule and Key Security Indicator", "Sample incident, vulnerability activity, and Ongoing Certification Reports for the package", "A trust center access check so FedRAMP can open every package file without an NDA or terms of service", "A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included", "Process design for inbox, incident, vulnerability, and quarterly reporting rules", "Support during FedRAMP review" ], "exclusions": [ "The underlying SOC 2, GovRAMP, or FedRAMP Rev5 audit", "Submitting the application on the client's behalf, which FedRAMP prohibits", "Engineering changes to the client's systems" ], "client_responsibilities": [ "Supply the alternative framework report and supporting materials", "Name a technical owner and an executive sponsor", "Operate the FedRAMP security inbox and incident processes once handed over", "Submit the FedRAMP Certification Application Form", { "text": "Produce the quarterly Ongoing Certification Report every 3 months after handover", "source_refs": [ "CCM-OCR-AVL" ], "link": { "label": "Drop Sequencer Assurance a note about custom retainers", "url": "https://sequencerassurance.com/contact/" } } ], "coverage": [ { "ref": "FRC-CLA-ASF", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "FRC-CLA-EAM", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-POP", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "readiness" }, { "ref": "MAS-CSO-IIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "CDS-CSO-PUB", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "CCM-OCR-NRD", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "CDS-CSO-UTC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-UTC-AAD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-INB", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-RCV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-CRA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-EFR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-FIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-DET", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-AVL", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IVV-CSX-AIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "KSI-CMT-LMC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "KSI-CNA-RNT", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "KSI-CED-RAT", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "KSI-IAM-AAM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "KSI-IAM-APM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "KSI-INR-RIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "KSI-SVC-SIN", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "FRC-CSO-PKG", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-JSN", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-APP-MLF", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "FRC-APP-FCP", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-AFC", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" } ], "related_services": [ { "id": "SVC-FED-B20", "relationship": "next_step", "note": "Agencies expect Class A offerings to pursue Class B, C, or D within 12 months." }, { "id": "SVC-FED-B5R", "relationship": "next_step", "note": "Class B on the Rev5 path, through FedRAMP or an agency sponsor." }, { "id": "SVC-FED-C20", "relationship": "next_step", "note": "Class C on the 20x path." }, { "id": "SVC-FED-C5R", "relationship": "next_step", "note": "Class C on the Rev5 path, through FedRAMP or an agency sponsor." } ], "faq": [ { "q": "Can Sequencer Assurance submit the FedRAMP application for the client?", "a": "No. FedRAMP prohibits third parties, including assessors, from applying on the client's behalf (FRC-APP-NTP). Sequencer Assurance prepares everything; the client submits." }, { "q": "Is an independent FedRAMP assessor required for Class A?", "a": "No. It is optional for Class A (FRC-CLA-IVV). Your SOC 2, GovRAMP, or FedRAMP Rev5 assessment carries the independent assessment." }, { "q": "How long can agencies rely on Class A?", "a": "Agencies should not use a Class A cloud service offering for more than 12 months unless it is actively pursuing Class B, C, or D (AGU-USE-CLA)." } ], "call_to_action": { "label": "Book a Class A readiness call", "url": "https://sequencerassurance.com/contact/" }, "updated": [ { "date": "2026-10-25", "comment": "Initial draft." }, { "date": "2026-10-25", "comment": "Set to active." } ] }, "SVC-FED-B20": { "slug": "fedramp-class-b-20x", "profile": { "type": "20x", "paths": [ "Program" ], "class": "B" }, "title": "FedRAMP 20x Class B Certification", "tagline": "Take a cloud service offering through its first full FedRAMP 20x assessment to Class B.", "description": "Sequencer Assurance prepares a cloud service offering for a FedRAMP 20x Class B Certification: scope and gap assessment, Marketplace listing, implementation evidence for every required Key Security Indicator, the FedRAMP operational processes Class B requires, and a schema-valid certification package. Sequencer Assurance then supports the client through the independent assessment by a FedRAMP Recognized assessor and prepares the package for the client to submit.", "category": "fedramp", "status": "active", "audience": { "for": [ "Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP 20x Class B certification", "Cloud service offerings with a Class A Certification that agencies expect to move to Class B within 12 months", "Cloud service offerings sold, or about to be sold, to US federal agencies directly or as a component of another cloud service offering" ], "not_for": [ "Cloud service offerings whose only government use is meeting other compliance programs such as CMMC", "Cloud service offerings that need a Rev5 Program Certification or an agency-sponsored path", "Cloud service offerings that need a Class C or Class D Certification" ] }, "eligibility": [ { "requirement": "A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly.", "blocking": true, "source_refs": [ "MKT-IIP-AGU", "MKT-FRP-SOF" ] }, { "requirement": "Not concurrently seeking a FedRAMP Rev5 Program Certification for the same cloud service offering.", "blocking": true, "source_refs": [ "FRC-CSO-POP" ] }, { "requirement": "Budget for an independent assessment by a FedRAMP Recognized assessor, initially and every year after certification.", "blocking": true, "source_refs": [ "FRC-APP-FIA", "IVV-CSO-FIA" ] }, { "requirement": "An existing Class A Certification, SOC 2 Type II, or GovRAMP assessment shortens the work but is not required.", "blocking": false } ], "outcomes": [ "A FedRAMP Marketplace listing with public human-readable and JSON information about the cloud service offering", "Implementation evidence for all 41 Key Security Indicators required for Class B, with at least one automated verification method each", "Running FedRAMP processes: security inbox, incident reporting, monthly vulnerability reporting, significant change notifications, quarterly Ongoing Certification Reports, and Quarterly Reviews", "A complete, schema-valid certification package that includes the independent assessment results, ready for the client to submit", "A Security Decision Record that addresses every MUST and SHOULD Class B rule and Key Security Indicator with an accurate implementation status, the independent assessor's summary for each, and timeframed plans for anything not yet fully implemented, plus historical Key Security Indicator metrics", "Package files FedRAMP can open from the trust center without an NDA or terms of service, so the package clears FedRAMP's pre-queue verification and enters the Review Queue sooner" ], "timeline": { "summary": "About 5 to 10 weeks of Sequencer Assurance and client work, plus the independent assessment. Marketplace listing and the operational build-out run alongside Key Security Indicator implementation.", "total": { "min": 5, "max": 10, "unit": "weeks", "estimate": true, "note": "Critical path through the phases, rounded up to whole weeks; build.py checks it." }, "client_effort": { "min": 20, "max": 60, "unit": "hours", "estimate": true, "note": "Spread across the engagement." }, "footnote": "Estimates cover Sequencer Assurance and client work only. Time for the independent assessment, which the assessor schedules, and for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by the assessor, FedRAMP, or GSA.", "phases": { "readiness": { "order": 1, "title": "Scope and gap assessment", "description": "Confirm the Class B certification profile, define the Minimum Assessment Scope with information flows and third-party resources, and measure the gap against every Class B rule and Key Security Indicator.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "owner": "sequencer-assurance", "deliverables": [ "gap-report" ] }, "marketplace": { "order": 2, "title": "Marketplace listing", "description": "Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing.", "duration": { "min": 1, "max": 1, "unit": "days" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "public-info" ] }, "ksi": { "order": 3, "title": "Key Security Indicator implementation", "description": "Close gaps in the required Key Security Indicators and set up at least one automated method to verify and validate each one.", "duration": { "min": 2, "max": 4, "unit": "weeks" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "ksi-evidence" ] }, "operations": { "order": 4, "title": "FedRAMP operational build-out", "description": "Stand up the security inbox, incident reporting, vulnerability detection and monthly reporting, significant change notifications, Ongoing Certification Reports and Quarterly Reviews, availability reporting, the trust center, the Secure Configuration Guide, and cryptographic module documentation.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "runbooks", "ocr-kit", "secure-configuration-guide" ] }, "package": { "order": 5, "title": "Certification package authoring", "description": "Write the Certification Package Overview and Security Decision Record, including Key Security Indicator summaries and relevant policies, in human-readable and JSON form validated against FedRAMP's schemas.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "ksi", "operations", "marketplace" ], "owner": "sequencer-assurance", "deliverables": [ "certification-package", "sample-reports" ] }, "assessment": { "order": 6, "title": "Independent assessment", "description": "A FedRAMP Recognized assessor verifies and validates the cloud service offering. Sequencer Assurance provides independent assessment support: evidence preparation, technical walkthroughs, and help responding to findings.", "duration": { "min": null, "max": null, "unit": "weeks", "note": "Scheduled by the assessor; not included in the estimate." }, "depends_on": [ "package" ], "owner": "assessor", "deliverables": [ "assessment-support" ] }, "submission": { "order": 7, "title": "Final validation and client submission", "description": "Add the assessment summary to the package, re-verify it against the live cloud service offering, then the client submits the FedRAMP Certification Application within 3 months of the assessment.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "assessment" ], "owner": "client", "deliverables": [ "submission-kit" ] }, "fedramp-review": { "order": 8, "title": "FedRAMP review", "description": "FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review.", "duration": { "min": null, "max": null, "unit": "weeks", "note": "Set by FedRAMP; not published in the rules dataset." }, "depends_on": [ "submission" ], "owner": "fedramp" } }, "clocks": [ { "name": "Assessment freshness", "description": "The independent assessment must have been completed by a FedRAMP Recognized assessor within the previous 3 months at application.", "window": { "min": null, "max": 3, "unit": "months", "estimate": false }, "source_refs": [ "FRC-APP-FIA" ] }, { "name": "Package freshness", "description": "The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days.", "window": { "min": null, "max": 7, "unit": "days", "estimate": false }, "source_refs": [ "FRC-APP-FCP" ] }, { "name": "Marketplace assessment deadline", "description": "An assessment for Class B, C, or D must be scheduled within 2 years of the initial Marketplace listing, or FedRAMP removes the listing.", "window": { "min": null, "max": 2, "unit": "years", "estimate": false }, "source_refs": [ "MKT-IIP-DLA" ] } ] }, "deliverables": { "gap-report": { "title": "Class B gap report", "description": "Status of every Class B rule and Key Security Indicator against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record.", "formats": [ "PDF", "JSON" ], "source_refs": [ "FRC-CSO-FCP", "MAS-CSO-IIR", "MAS-CSO-FLO", "MAS-CSO-TPR" ] }, "public-info": { "title": "Public cloud service offering information", "description": "Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report and review dates.", "formats": [ "HTML", "JSON" ], "source_refs": [ "CDS-CSO-PUB", "CDS-CSO-SVC", "CCM-OCR-NRD", "CCM-QTR-NRD" ] }, "ksi-evidence": { "title": "Key Security Indicator evidence", "description": "For each required Key Security Indicator: the measures in place, how they are verified and validated, at least one automated method, and historical metrics.", "formats": [ "JSON", "Markdown" ], "source_refs": [ "SDR-CSX-KSI", "SDR-CSX-KMT", "FRC-CSX-VVK", "IVV-CSX-AIA" ] }, "runbooks": { "title": "FedRAMP operating runbooks", "description": "Procedures for the security inbox, incident reports, vulnerability detection, evaluation and monthly reporting, and significant change notifications.", "formats": [ "Markdown", "PDF" ], "source_refs": [ "AFC-CSO-INB", "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "VDR-CSO-RES", "VER-TFR-MHR", "SCN-CSO-EVA" ] }, "ocr-kit": { "title": "Ongoing Certification Report and Quarterly Review kit", "description": "Quarterly report template and example, feedback mechanism, and Quarterly Review agenda and registration setup.", "formats": [ "PDF", "JSON" ], "source_refs": [ "CCM-OCR-AVL", "CCM-OCR-FBM", "CCM-QTR-REG" ] }, "secure-configuration-guide": { "title": "Secure Configuration Guide", "description": "Recommended secure settings for the cloud service offering, with instructions in the package for obtaining and using it.", "formats": [ "HTML", "PDF" ], "source_refs": [ "SCG-CSO-RSC", "SCG-CSO-AUP" ] }, "certification-package": { "title": "Certification package", "description": "Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class B rule and Key Security Indicator. Each entry carries an implementation status, the independent assessor's assessment summary, and, where partially or not implemented, the reason and a plan with timeframes. The Security Decision Record also carries historical Key Security Indicator metrics. Includes Key Security Indicator summaries, relevant policies, cryptographic module documentation, and every referenced artifact and piece of evidence, all reachable from the trust center without an NDA or terms of service.", "formats": [ "HTML", "JSON" ], "source_refs": [ "FRC-CSO-PKG", "CPO-CSO-OVR", "SDR-CSO-FRR", "CDS-CSO-IRP", "CMU-CSO-CMD", "IVV-IAS-SUM", "FRC-CSX-VVR" ] }, "sample-reports": { "title": "Sample incident, change, and vulnerability reports", "description": "Filled samples of the Initial, Ongoing, and Final Incident Reports, a Significant Change Notification, and vulnerability reporting with vulnerability details and accepted vulnerability information, plus historical vulnerability detection and response activity, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident, change, or report has occurred.", "formats": [ "HTML", "JSON" ], "source_refs": [ "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "SCN-CSO-INF", "VER-RPT-VDT", "VER-RPT-AVI", "VER-TFR-MRH" ] }, "assessment-support": { "title": "Assessment support", "description": "Evidence of implementation and effectiveness organized for the assessor, technical walkthroughs, and help responding to findings.", "formats": [ "JSON", "PDF" ], "source_refs": [ "IVV-CSO-SEI", "IVV-CSO-SEE", "IVV-CSO-ICP" ] }, "submission-kit": { "title": "Submission kit", "description": "Final validation record, the assessor's overall summary added to the package, and a pre-filled guide for the client's FedRAMP Certification Application Form.", "formats": [ "PDF" ], "source_refs": [ "FRC-APP-FCP", "FRC-APP-FIA", "CPO-CSO-OSA", "IVV-IAS-OSA", "FRC-APP-AFC", "FRC-APP-NTP" ] } }, "cost": { "model": "tiered", "currency": "USD", "price": { "min": 80000, "max": 120000 }, "display": "$80,000 when the client provides GRC tooling, or $120,000 all-in with Sequencer Assurance providing all GRC technology and tooling", "tiers": { "client-tooling": { "title": "Client tooling", "description": "The client provides the GRC technology and tooling, including a FedRAMP-compatible trust center.", "price": { "min": 80000, "max": 80000 }, "includes": [ "The full fixed-scope 20x Class B engagement" ], "source_refs": [ "CDS-CSO-UTC" ] }, "all-in": { "title": "All-in", "description": "Sequencer Assurance provides all GRC technology and tooling, including the trust center.", "price": { "min": 120000, "max": 120000 }, "includes": [ "The full fixed-scope 20x Class B engagement", "All GRC technology and tooling, provided by Sequencer Assurance" ], "source_refs": [ "CDS-CSO-UTC", "CDS-TRC-PAC", "CDS-TRC-ACL", "CDS-TRC-AAI" ] } }, "add_ons": [ { "title": "GRC tools from the client's maturity roadmap", "description": "Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee.", "pricing": "quoted", "requires_client_approval": true } ], "billing": [ { "milestone": "Kickoff", "percent": 50 }, { "milestone": "Independent assessment performed", "percent": 50 } ], "third_party_costs": [ "Independent assessment by a FedRAMP Recognized assessor (required initially and every year)", "Licensing for the client's own GRC tooling and trust center (client tooling tier)" ] }, "inclusions": [ "Gap assessment against all 92 required Class B rules and 41 required Key Security Indicators, plus the optional rules the client already meets", "Authoring of the certification package, public JSON, and Secure Configuration Guide in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator", "Historical Key Security Indicator metrics for the Security Decision Record", "Sample incident, significant change, vulnerability, and Ongoing Certification Reports for the package", "A trust center access check so FedRAMP can open every package file without an NDA or terms of service", "A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included", "Design of automated verification and validation for the Security Decision Record's rule entries, which FedRAMP recommends for Class B and C; the client implements it", "Process design for inbox, incident, vulnerability, significant change, and quarterly reporting rules", "Evidence preparation and support during the independent assessment", "Support during FedRAMP review" ], "exclusions": [ "The independent assessment itself, which a separate FedRAMP Recognized assessor performs", "Submitting the application on the client's behalf, which FedRAMP prohibits", "Engineering changes to the client's systems" ], "client_responsibilities": [ "Name a technical owner and an executive sponsor", "Engage and pay a FedRAMP Recognized assessor", "Supply evidence of implementation and effectiveness to the assessor", "Submit the FedRAMP Certification Application Form", { "text": "After handover, keep the package current monthly, report vulnerability activity monthly, and produce the quarterly Ongoing Certification Report and Quarterly Review", "source_refs": [ "CPO-CSX-CPM", "VER-TFR-MHR", "CCM-OCR-AVL", "CCM-QTR-MTG" ], "link": { "label": "Drop Sequencer Assurance a note about custom retainers", "url": "https://sequencerassurance.com/contact/" } } ], "coverage": [ { "ref": "FRC-CSO-FCP", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "FRC-CSO-POP", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "readiness" }, { "ref": "MAS-CSO-FLO", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-IIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-MDI", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-TPR", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "CCM-OCR-NRD", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "CDS-CSO-PUB", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "FRC-APP-MLF", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "MKT-CSO-MLR", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "MKT-CSO-PML", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "KSI-CED-RAT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CMT-LMC", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CMT-RMV", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CMT-RVP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CMT-VTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-DFP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-IBP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-MAT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-OFA", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-RNT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-RVP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-ULN", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-AAM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-APM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-ELP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-JIT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-SNU", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-SUS", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-INR-AAR", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-INR-RIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-INR-RPI", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-MLA-EVC", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-MLA-LET", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-MLA-OSM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-MLA-RVL", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-GIV", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-RES", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-RIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-RSD", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-RVD", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-RPL-ABO", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-RPL-ARP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-RPL-RRO", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-RPL-TRC", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SCR-MIT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SCR-MON", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-ACM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-ASM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-EIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-SIN", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-VRI", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "AFC-CSO-CRA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-EMR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-INB", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-NOC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-RCV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-TFG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-AFS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-AVL", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-FBM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-LSI", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "CCM-QTR-NID", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "CCM-QTR-NRD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-QTR-REG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-AVR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-CBF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-FID", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-FRC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-HAD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-IRP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-RIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-SVC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-UTC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-AAI", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-ACL", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-PAC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-USH", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-UTC-AAD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CMU-CSO-CMD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-DPR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-EFR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-FIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-IIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-OIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCG-CSO-AUP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCG-CSO-RSC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-ADP-NTF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-EVA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-HIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-HRM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-INF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-MAR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NAF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NFP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NIP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-UPD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-DET", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-FAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-RES", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-TFR-MVX", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-TFR-NMV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-AIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-EIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-ELX", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-EPA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-AVI", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-NID", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "VER-RPT-PER", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-VDT", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-TFR-MAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-TFR-MHR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CPO-CSO-MTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-OSA", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-OVR", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSX-CPM", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-JSN", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-MRA", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-PKG", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSO-FRR", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSO-MTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSX-KSI", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "IVV-CSO-DUS", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-FIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-ICP", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-SEE", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-SEI", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSX-AIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "FRC-APP-AFC", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-FCP", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-FIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-NTP", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "submission" } ], "related_services": [ { "id": "SVC-FED-CLA", "relationship": "alternative", "note": "Class A can cover agency use for up to 12 months while Class B is underway." }, { "id": "SVC-FED-B5R", "relationship": "alternative", "note": "Class B on the Rev5 path, including agency sponsorship." }, { "id": "SVC-FED-C20", "relationship": "alternative", "note": "20x Class C, for cloud service offerings that need more assurance." } ], "faq": [ { "q": "Should the client pursue Class B on 20x or Rev5?", "a": "20x is FedRAMP's modern approach based primarily on measured outcomes, using Key Security Indicators with automated validation. Rev5 is the legacy approach based primarily on documented plans, using NIST SP 800-53 controls, and is the only type with an agency-sponsored path (FRD-CTY, FRD-CPH). A cloud service offering cannot seek both Program Certification types at once (FRC-CSO-POP)." }, { "q": "Does Class B require Class A or another framework first?", "a": "No. Class B stands on its own independent assessment. A Class A Certification can cover agency use for up to 12 months while Class B is underway (AGU-USE-CLA)." }, { "q": "Is an independent assessor required for Class B?", "a": "Yes. The client needs an assessment by a FedRAMP Recognized assessor completed within 3 months before applying (FRC-APP-FIA), and every year after certification (IVV-CSO-FIA)." }, { "q": "What does the cloud service offering need to keep doing after certification?", "a": "Keep the package current monthly (CPO-CSX-CPM), report vulnerability activity monthly (VER-TFR-MHR), verify machine-based resources every 7 days (VDR-TFR-MVX), publish a quarterly Ongoing Certification Report (CCM-OCR-AVL), and complete an annual independent assessment (IVV-CSO-FIA)." }, { "q": "Can Sequencer Assurance submit the FedRAMP application for the client?", "a": "No. FedRAMP prohibits third parties, including assessors, from applying on the client's behalf (FRC-APP-NTP). Sequencer Assurance prepares everything; the client submits." } ], "call_to_action": { "label": "Book a 20x Class B readiness call", "url": "https://sequencerassurance.com/contact/" }, "updated": [ { "date": "2026-10-25", "comment": "Initial draft." }, { "date": "2026-10-25", "comment": "Set to active." } ] }, "SVC-FED-B5R": { "slug": "fedramp-class-b-rev5", "profile": { "type": "Rev5", "paths": [ "Program", "Agency" ], "class": "B" }, "title": "FedRAMP Rev5 Class B Certification", "tagline": "Take a cloud service offering to FedRAMP Rev5 Class B, through FedRAMP or an agency sponsor.", "description": "Sequencer Assurance prepares a cloud service offering for a FedRAMP Rev5 Class B Certification on either path: directly through FedRAMP, or with an agency sponsor. The work covers scope and gap assessment, Marketplace listing, implementation and documentation of the 155 NIST SP 800-53 Rev. 5 controls Class B requires, the FedRAMP operational processes, and a schema-valid certification package. Sequencer Assurance then supports the client through the independent assessment by a FedRAMP Recognized assessor and prepares the package for the client to submit.", "category": "fedramp", "status": "active", "audience": { "for": [ "Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP Rev5 Class B certification", "Cloud service offerings with an agency sponsor ready to issue an Authorization to Operate", "Cloud service offerings with FedRAMP Ready status that must convert to a FedRAMP Certification", "Cloud service offerings with a Class A Certification that agencies expect to move to Class B within 12 months" ], "not_for": [ "Cloud service offerings whose only government use is meeting other compliance programs such as CMMC", "Cloud service offerings pursuing a FedRAMP 20x Program Certification", "Cloud service offerings that need a Class C or Class D Certification" ] }, "eligibility": [ { "requirement": "A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly.", "blocking": true, "source_refs": [ "MKT-IIP-AGU", "MKT-FRP-SOF" ] }, { "requirement": "Not concurrently seeking a FedRAMP 20x Program Certification for the same cloud service offering.", "blocking": true, "source_refs": [ "FRC-CSO-POP" ] }, { "requirement": "Budget for an independent assessment by a FedRAMP Recognized assessor, initially and every year after certification.", "blocking": true, "source_refs": [ "FRC-APP-FIA", "IVV-CSO-FIA" ] }, { "requirement": "Agency path only: the sponsoring agency completes its Authorization to Operate and sends the signed ATO letter to FedRAMP.", "blocking": true, "source_refs": [ "FRC-APS-ATO" ] }, { "requirement": "An existing FedRAMP Ready status, Class A Certification, SOC 2 Type II, or GovRAMP assessment shortens the work but is not required.", "blocking": false } ], "outcomes": [ "A FedRAMP Marketplace listing with public human-readable and JSON information about the cloud service offering", "Implementation and documentation of all 155 NIST SP 800-53 Rev. 5 controls required for Class B, with every organization-defined parameter assigned", "Running FedRAMP processes: security inbox, incident reporting, monthly vulnerability reporting, significant change notifications, quarterly Ongoing Certification Reports, and Quarterly Reviews", "A complete, schema-valid certification package that includes the independent assessment results, ready for the client to submit", "A Security Decision Record that addresses every MUST and SHOULD Class B rule and control with an accurate implementation status, the independent assessor's summary for each, and timeframed plans for anything not yet fully implemented", "Package files FedRAMP can open from the trust center without an NDA or terms of service, so the package clears FedRAMP's pre-queue verification and enters the Review Queue sooner" ], "timeline": { "summary": "About 4 to 8 weeks of Sequencer Assurance and client work, plus the independent assessment. Marketplace listing and the operational build-out run alongside control implementation and documentation.", "total": { "min": 4, "max": 8, "unit": "weeks", "estimate": true, "note": "Critical path through the phases, rounded up to whole weeks; build.py checks it." }, "client_effort": { "min": 20, "max": 60, "unit": "hours", "estimate": true, "note": "Spread across the engagement." }, "footnote": "Estimates cover Sequencer Assurance and client work only. Time for the independent assessment, which the assessor schedules, and for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by the assessor, FedRAMP, or GSA.", "phases": { "readiness": { "order": 1, "title": "Scope and gap assessment", "description": "Confirm the Rev5 Class B certification profile and path, define the Minimum Assessment Scope with information flows and third-party resources, and measure the gap against every Class B rule and control.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "owner": "sequencer-assurance", "deliverables": [ "gap-report" ] }, "marketplace": { "order": 2, "title": "Marketplace listing", "description": "Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing.", "duration": { "min": 1, "max": 1, "unit": "days" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "public-info" ] }, "controls": { "order": 3, "title": "Control implementation and documentation", "description": "Close gaps in the 155 required controls, assign every organization-defined parameter, and document each control following FedRAMP Rev5 Controls Guidance.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "control-documentation" ] }, "operations": { "order": 4, "title": "FedRAMP operational build-out", "description": "Stand up the security inbox, incident reporting, vulnerability detection and monthly reporting, significant change notifications, Ongoing Certification Reports and Quarterly Reviews, availability reporting, the trust center, the Secure Configuration Guide, and cryptographic module documentation.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "runbooks", "ocr-kit", "secure-configuration-guide" ] }, "package": { "order": 5, "title": "Certification package authoring", "description": "Write the Certification Package Overview and Security Decision Record, including control summaries, parameter assignments, and relevant policies, in human-readable and JSON form validated against FedRAMP's schemas.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "controls", "operations", "marketplace" ], "owner": "sequencer-assurance", "deliverables": [ "certification-package", "sample-reports" ] }, "assessment": { "order": 6, "title": "Independent assessment", "description": "A FedRAMP Recognized assessor verifies and validates the cloud service offering. Sequencer Assurance provides independent assessment support: evidence preparation, technical walkthroughs, and help responding to findings.", "duration": { "min": null, "max": null, "unit": "weeks", "note": "Scheduled by the assessor; not included in the estimate." }, "depends_on": [ "package" ], "owner": "assessor", "deliverables": [ "assessment-support" ] }, "submission": { "order": 7, "title": "Final validation and client submission", "description": "Add the assessment summary to the package, re-verify it against the live cloud service offering, then the client submits the FedRAMP Certification Application within 3 months of the assessment. On the agency path, the sponsoring agency also sends its signed ATO letter to FedRAMP.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "assessment" ], "owner": "client", "deliverables": [ "submission-kit" ] }, "fedramp-review": { "order": 8, "title": "FedRAMP review", "description": "FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review.", "duration": { "min": null, "max": null, "unit": "weeks", "note": "Set by FedRAMP; not published in the rules dataset." }, "depends_on": [ "submission" ], "owner": "fedramp" } }, "clocks": [ { "name": "Assessment freshness", "description": "The independent assessment must have been completed by a FedRAMP Recognized assessor within the previous 3 months at application.", "window": { "min": null, "max": 3, "unit": "months", "estimate": false }, "source_refs": [ "FRC-APP-FIA" ] }, { "name": "Package freshness", "description": "The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days.", "window": { "min": null, "max": 7, "unit": "days", "estimate": false }, "source_refs": [ "FRC-APP-FCP" ] }, { "name": "Marketplace assessment deadline", "description": "An assessment for Class B, C, or D must be scheduled within 2 years of the initial Marketplace listing, or FedRAMP removes the listing.", "window": { "min": null, "max": 2, "unit": "years", "estimate": false }, "source_refs": [ "MKT-IIP-DLA" ] }, { "name": "FedRAMP Ready conversion", "description": "Cloud service offerings with FedRAMP Ready status must convert to a FedRAMP Certification by November 17, 2026 or the expiration of their annual assessment, whichever is later.", "window": { "min": null, "max": null, "unit": "days", "estimate": false, "note": "Fixed date: November 17, 2026, or annual assessment expiry if later" }, "source_refs": [ "FRC-CSF-RDY" ] } ] }, "deliverables": { "gap-report": { "title": "Class B gap report", "description": "Status of every Class B rule and control against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record.", "formats": [ "PDF", "JSON" ], "source_refs": [ "FRC-CSO-FCP", "MAS-CSO-IIR", "MAS-CSO-FLO", "MAS-CSO-TPR" ] }, "public-info": { "title": "Public cloud service offering information", "description": "Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report and review dates.", "formats": [ "HTML", "JSON" ], "source_refs": [ "CDS-CSO-PUB", "CDS-CSO-SVC", "CCM-OCR-NRD", "CCM-QTR-NRD" ] }, "control-documentation": { "title": "Control implementation documentation", "description": "Implementation summaries for the 155 required controls and the organization-defined parameter assignments.", "formats": [ "JSON", "Markdown" ], "source_refs": [ "FRC-CSF-BSL", "FRC-CSF-ACP", "FRC-CSF-FFG", "SDR-CSF-CTF" ] }, "runbooks": { "title": "FedRAMP operating runbooks", "description": "Procedures for the security inbox, incident reports, vulnerability detection, evaluation and monthly reporting, and significant change notifications.", "formats": [ "Markdown", "PDF" ], "source_refs": [ "AFC-CSO-INB", "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "VDR-CSO-RES", "VER-TFR-MHR", "SCN-CSO-EVA" ] }, "ocr-kit": { "title": "Ongoing Certification Report and Quarterly Review kit", "description": "Quarterly report template and example, feedback mechanism, and Quarterly Review agenda and registration setup.", "formats": [ "PDF", "JSON" ], "source_refs": [ "CCM-OCR-AVL", "CCM-OCR-FBM", "CCM-QTR-REG" ] }, "secure-configuration-guide": { "title": "Secure Configuration Guide", "description": "Recommended secure settings for the cloud service offering, with instructions in the package for obtaining and using it.", "formats": [ "HTML", "PDF" ], "source_refs": [ "SCG-CSO-RSC", "SCG-CSO-AUP" ] }, "certification-package": { "title": "Certification package", "description": "Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class B rule and control. Each entry carries an implementation status, the independent assessor's assessment summary, and, where partially or not implemented, the reason and a plan with timeframes. Includes control summaries, relevant policies, cryptographic module documentation, and every referenced artifact and piece of evidence, all reachable from the trust center without an NDA or terms of service.", "formats": [ "HTML", "JSON" ], "source_refs": [ "FRC-CSO-PKG", "CPO-CSO-OVR", "SDR-CSO-FRR", "CDS-CSO-IRP", "CMU-CSO-CMD", "IVV-IAS-SUM" ] }, "sample-reports": { "title": "Sample incident, change, and vulnerability reports", "description": "Filled samples of the Initial, Ongoing, and Final Incident Reports, a Significant Change Notification, and vulnerability reporting with vulnerability details and accepted vulnerability information, plus historical vulnerability detection and response activity, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident, change, or report has occurred.", "formats": [ "HTML", "JSON" ], "source_refs": [ "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "SCN-CSO-INF", "VER-RPT-VDT", "VER-RPT-AVI", "VER-TFR-MRH" ] }, "assessment-support": { "title": "Assessment support", "description": "Evidence of implementation and effectiveness organized for the assessor, technical walkthroughs, and help responding to findings.", "formats": [ "JSON", "PDF" ], "source_refs": [ "IVV-CSO-SEI", "IVV-CSO-SEE", "IVV-CSO-ICP" ] }, "submission-kit": { "title": "Submission kit", "description": "Final validation record, the assessor's overall summary added to the package, and a pre-filled guide for the client's FedRAMP Certification Application Form.", "formats": [ "PDF" ], "source_refs": [ "FRC-APP-FCP", "FRC-APP-FIA", "CPO-CSO-OSA", "IVV-IAS-OSA", "FRC-APP-AFC", "FRC-APP-NTP", "FRC-APS-ATO" ] } }, "cost": { "model": "tiered", "currency": "USD", "display": "$120,000 all-in with Sequencer Assurance providing all GRC technology and tooling, or a custom quote when the client provides GRC tooling", "tiers": { "client-tooling": { "title": "Client tooling", "description": "The client provides the GRC technology and tooling, including a FedRAMP-compatible trust center. Priced per client because tooling varies widely.", "pricing": "quoted", "price": { "min": null, "max": null }, "includes": [ "The full fixed-scope Rev5 Class B engagement" ], "source_refs": [ "CDS-CSO-UTC" ] }, "all-in": { "title": "All-in", "description": "Sequencer Assurance provides all GRC technology and tooling, including the trust center.", "price": { "min": 120000, "max": 120000 }, "includes": [ "The full fixed-scope Rev5 Class B engagement", "All GRC technology and tooling, provided by Sequencer Assurance" ], "source_refs": [ "CDS-CSO-UTC", "CDS-TRC-PAC", "CDS-TRC-ACL", "CDS-TRC-AAI" ] } }, "add_ons": [ { "title": "GRC tools from the client's maturity roadmap", "description": "Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee.", "pricing": "quoted", "requires_client_approval": true } ], "billing": [ { "milestone": "Kickoff", "percent": 50 }, { "milestone": "Independent assessment performed", "percent": 50 } ], "third_party_costs": [ "Independent assessment by a FedRAMP Recognized assessor (required initially, then 35 named controls every year and all controls every 3 years)", "Licensing for the client's own GRC tooling and trust center (client tooling tier)" ] }, "inclusions": [ "Gap assessment against all 99 required Class B rules and 155 required controls, plus the optional rules the client already meets", "Control documentation, the certification package, public JSON, and the Secure Configuration Guide in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator", "Sample incident, significant change, vulnerability, and Ongoing Certification Reports for the package", "A trust center access check so FedRAMP can open every package file without an NDA or terms of service", "A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included", "Process design for inbox, incident, vulnerability, significant change, and quarterly reporting rules", "Evidence preparation and support during the independent assessment", "Support during FedRAMP review" ], "exclusions": [ "The independent assessment itself, which a separate FedRAMP Recognized assessor performs", "The sponsoring agency's Authorization to Operate process on the agency path", "Submitting the application on the client's behalf, which FedRAMP prohibits", "Engineering changes to the client's systems" ], "client_responsibilities": [ "Name a technical owner and an executive sponsor", "Agency path: coordinate the Authorization to Operate with the sponsoring agency", "Engage and pay a FedRAMP Recognized assessor", "Supply evidence of implementation and effectiveness to the assessor", "Submit the FedRAMP Certification Application Form", { "text": "After handover, keep the package current at least yearly, report vulnerability activity monthly, produce the quarterly Ongoing Certification Report and Quarterly Review, and include previously failed controls in the next assessment", "source_refs": [ "CPO-CSF-CPM", "VER-TFR-MHR", "CCM-OCR-AVL", "CCM-QTR-MTG", "IVV-CSF-ACF" ], "link": { "label": "Drop Sequencer Assurance a note about custom retainers", "url": "https://sequencerassurance.com/contact/" } } ], "coverage": [ { "ref": "FRC-CSF-RDY", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "FRC-CSO-FCP", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "FRC-CSO-POP", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "readiness" }, { "ref": "MAS-CSO-FLO", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-IIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-MDI", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-TPR", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "CCM-OCR-NRD", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "CDS-CSO-PUB", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "FRC-APP-MLF", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "MKT-CSO-MLR", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "MKT-CSO-PML", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "FRC-CSF-ACP", "source": "fedramp-rules", "force": "MUST", "handled_in": "controls" }, { "ref": "FRC-CSF-BSL", "source": "fedramp-rules", "force": "MUST", "handled_in": "controls" }, { "ref": "FRC-CSF-FFG", "source": "fedramp-rules", "force": "MUST", "handled_in": "controls" }, { "ref": "AFC-CSO-CRA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-EMR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-INB", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-NOC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-RCV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-TFG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-AFS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-AVL", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-FBM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-LSI", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "CCM-QTR-NID", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "CCM-QTR-NRD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-QTR-REG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSF-TCM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-AVR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-CBF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-FID", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-FRC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-HAD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-IRP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-RIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-SVC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-UTC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-AAI", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-ACL", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-PAC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-USH", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-UTC-AAD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CMU-CSO-CMD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-DPR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-EFR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-FIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-IIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-OIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCG-CSO-AUP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCG-CSO-RSC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-ADP-NTF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-EVA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-HIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-HRM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-INF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-MAR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NAF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NFP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NIP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-UPD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-DET", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-FAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-RES", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-TFR-NMV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-AIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-EIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-ELX", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-EPA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-AVI", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-NID", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "VER-RPT-PER", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-VDT", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-TFR-MAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-TFR-MHR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CPO-CSF-CPM", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-MTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-OSA", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-OVR", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-JSN", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-MRA", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-PKG", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSF-CTF", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSO-FRR", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSO-MTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "IVV-CSF-ACF", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSF-AIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSF-MCA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-DUS", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-FIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-ICP", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-SEE", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-SEI", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "FRC-APP-AFC", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-FCP", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-FIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-NTP", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "submission" }, { "ref": "FRC-APS-ATO", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" } ], "related_services": [ { "id": "SVC-FED-B20", "relationship": "alternative", "note": "Class B on the 20x path, using Key Security Indicators." }, { "id": "SVC-FED-CLA", "relationship": "alternative", "note": "Class A can cover agency use for up to 12 months while Class B is underway." }, { "id": "SVC-FED-C5R", "relationship": "alternative", "note": "Rev5 Class C, for cloud service offerings that need more assurance." } ], "faq": [ { "q": "Should the client pursue Class B on 20x or Rev5?", "a": "20x is FedRAMP's modern approach based primarily on measured outcomes, using Key Security Indicators with automated validation. Rev5 is the legacy approach based primarily on documented plans, using NIST SP 800-53 controls, and is the only type with an agency-sponsored path (FRD-CTY, FRD-CPH). A cloud service offering cannot seek both Program Certification types at once (FRC-CSO-POP)." }, { "q": "What is the difference between the Program and Agency paths?", "a": "On the Program path, FedRAMP certifies the cloud service offering directly. On the Agency path, a sponsoring agency completes its own Authorization to Operate and sends the signed ATO letter to FedRAMP, which still reviews and approves the certification (FRD-CPH, FRC-APS-ATO)." }, { "q": "When do the Rev5 rules become required?", "a": "New Rev5 certifications must follow these rules from January 1, 2027. They can be adopted now." }, { "q": "Is an independent assessor required for Class B?", "a": "Yes. The client needs an assessment by a FedRAMP Recognized assessor completed within 3 months before applying (FRC-APP-FIA). After certification, 35 named controls are assessed every year and all controls at least every 3 years (IVV-CSF-AIA, IVV-CSF-MCA)." }, { "q": "Can Sequencer Assurance submit the FedRAMP application for the client?", "a": "No. FedRAMP prohibits third parties, including assessors, from applying on the client's behalf (FRC-APP-NTP). Sequencer Assurance prepares everything; the client submits." } ], "call_to_action": { "label": "Book a Rev5 Class B readiness call", "url": "https://sequencerassurance.com/contact/" }, "updated": [ { "date": "2026-10-25", "comment": "Initial draft." }, { "date": "2026-10-25", "comment": "Set to active." } ] }, "SVC-FED-C20": { "slug": "fedramp-class-c-20x", "profile": { "type": "20x", "paths": [ "Program" ], "class": "C" }, "title": "FedRAMP 20x Class C Certification", "tagline": "Take a cloud service offering through a full FedRAMP 20x assessment to Class C.", "description": "Sequencer Assurance prepares a cloud service offering for a FedRAMP 20x Class C Certification: scope and gap assessment, Marketplace listing, implementation evidence for every required Key Security Indicator, the FedRAMP operational processes Class C requires, and a schema-valid certification package. Sequencer Assurance then supports the client through the independent assessment by a FedRAMP Recognized assessor and prepares the package for the client to submit.", "category": "fedramp", "status": "active", "audience": { "for": [ "Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP 20x Class C certification", "Cloud service offerings with a Class A or Class B Certification that need Class C", "Cloud service offerings sold, or about to be sold, to US federal agencies directly or as a component of another cloud service offering" ], "not_for": [ "Cloud service offerings whose only government use is meeting other compliance programs such as CMMC", "Cloud service offerings that need a Rev5 Program Certification or an agency-sponsored path", "Cloud service offerings that need a Class B or Class D Certification" ] }, "eligibility": [ { "requirement": "A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly.", "blocking": true, "source_refs": [ "MKT-IIP-AGU", "MKT-FRP-SOF" ] }, { "requirement": "Not concurrently seeking a FedRAMP Rev5 Program Certification for the same cloud service offering.", "blocking": true, "source_refs": [ "FRC-CSO-POP" ] }, { "requirement": "Budget for an independent assessment by a FedRAMP Recognized assessor, initially and every year after certification.", "blocking": true, "source_refs": [ "FRC-APP-FIA", "IVV-CSO-FIA" ] }, { "requirement": "An existing Class A Certification, SOC 2 Type II, or GovRAMP assessment shortens the work but is not required.", "blocking": false } ], "outcomes": [ "A FedRAMP Marketplace listing with public human-readable and JSON information about the cloud service offering", "Implementation evidence for all 46 Key Security Indicators required for Class C, with required automated verification for each and historical metrics", "Running FedRAMP processes: security inbox, incident reporting, monthly vulnerability reporting, significant change notifications, quarterly Ongoing Certification Reports, and Quarterly Reviews", "A complete, schema-valid certification package that includes the independent assessment results, ready for the client to submit", "A Security Decision Record that addresses every MUST and SHOULD Class C rule and Key Security Indicator with an accurate implementation status, the independent assessor's summary for each, and timeframed plans for anything not yet fully implemented, plus historical Key Security Indicator metrics", "Package files FedRAMP can open from the trust center without an NDA or terms of service, so the package clears FedRAMP's pre-queue verification and enters the Review Queue sooner" ], "timeline": { "summary": "About 5 to 10 weeks of Sequencer Assurance and client work, plus the independent assessment. Marketplace listing and the operational build-out run alongside Key Security Indicator implementation.", "total": { "min": 5, "max": 10, "unit": "weeks", "estimate": true, "note": "Critical path through the phases, rounded up to whole weeks; build.py checks it." }, "client_effort": { "min": 20, "max": 60, "unit": "hours", "estimate": true, "note": "Spread across the engagement." }, "footnote": "Estimates cover Sequencer Assurance and client work only. Time for the independent assessment, which the assessor schedules, and for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by the assessor, FedRAMP, or GSA.", "phases": { "readiness": { "order": 1, "title": "Scope and gap assessment", "description": "Confirm the Class C certification profile, define the Minimum Assessment Scope with information flows and third-party resources, and measure the gap against every Class C rule and Key Security Indicator.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "owner": "sequencer-assurance", "deliverables": [ "gap-report" ] }, "marketplace": { "order": 2, "title": "Marketplace listing", "description": "Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing.", "duration": { "min": 1, "max": 1, "unit": "days" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "public-info" ] }, "ksi": { "order": 3, "title": "Key Security Indicator implementation", "description": "Close gaps in the required Key Security Indicators and set up the automated methods Class C requires to verify and validate each one, with historical metrics.", "duration": { "min": 2, "max": 4, "unit": "weeks" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "ksi-evidence" ] }, "operations": { "order": 4, "title": "FedRAMP operational build-out", "description": "Stand up the security inbox, incident reporting, vulnerability detection and monthly reporting, significant change notifications, Ongoing Certification Reports and Quarterly Reviews, availability reporting, the trust center, the Secure Configuration Guide, and cryptographic module documentation.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "runbooks", "ocr-kit", "secure-configuration-guide" ] }, "package": { "order": 5, "title": "Certification package authoring", "description": "Write the Certification Package Overview and Security Decision Record, including Key Security Indicator summaries and relevant policies, in human-readable and JSON form validated against FedRAMP's schemas.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "ksi", "operations", "marketplace" ], "owner": "sequencer-assurance", "deliverables": [ "certification-package", "sample-reports" ] }, "assessment": { "order": 6, "title": "Independent assessment", "description": "A FedRAMP Recognized assessor verifies and validates the cloud service offering. Sequencer Assurance provides independent assessment support: evidence preparation, technical walkthroughs, and help responding to findings.", "duration": { "min": null, "max": null, "unit": "weeks", "note": "Scheduled by the assessor; not included in the estimate." }, "depends_on": [ "package" ], "owner": "assessor", "deliverables": [ "assessment-support" ] }, "submission": { "order": 7, "title": "Final validation and client submission", "description": "Add the assessment summary to the package, re-verify it against the live cloud service offering, then the client submits the FedRAMP Certification Application within 3 months of the assessment.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "assessment" ], "owner": "client", "deliverables": [ "submission-kit" ] }, "fedramp-review": { "order": 8, "title": "FedRAMP review", "description": "FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review.", "duration": { "min": null, "max": null, "unit": "weeks", "note": "Set by FedRAMP; not published in the rules dataset." }, "depends_on": [ "submission" ], "owner": "fedramp" } }, "clocks": [ { "name": "Assessment freshness", "description": "The independent assessment must have been completed by a FedRAMP Recognized assessor within the previous 3 months at application.", "window": { "min": null, "max": 3, "unit": "months", "estimate": false }, "source_refs": [ "FRC-APP-FIA" ] }, { "name": "Package freshness", "description": "The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days.", "window": { "min": null, "max": 7, "unit": "days", "estimate": false }, "source_refs": [ "FRC-APP-FCP" ] }, { "name": "Marketplace assessment deadline", "description": "An assessment for Class B, C, or D must be scheduled within 2 years of the initial Marketplace listing, or FedRAMP removes the listing.", "window": { "min": null, "max": 2, "unit": "years", "estimate": false }, "source_refs": [ "MKT-IIP-DLA" ] } ] }, "deliverables": { "gap-report": { "title": "Class C gap report", "description": "Status of every Class C rule and Key Security Indicator against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record.", "formats": [ "PDF", "JSON" ], "source_refs": [ "FRC-CSO-FCP", "MAS-CSO-IIR", "MAS-CSO-FLO", "MAS-CSO-TPR" ] }, "public-info": { "title": "Public cloud service offering information", "description": "Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report and review dates.", "formats": [ "HTML", "JSON" ], "source_refs": [ "CDS-CSO-PUB", "CDS-CSO-SVC", "CCM-OCR-NRD", "CCM-QTR-NRD" ] }, "ksi-evidence": { "title": "Key Security Indicator evidence", "description": "For each required Key Security Indicator: the measures in place, how they are verified and validated, the required automated methods, and historical metrics.", "formats": [ "JSON", "Markdown" ], "source_refs": [ "SDR-CSX-KSI", "SDR-CSX-KMT", "FRC-CSX-VVK", "IVV-CSX-AIA" ] }, "runbooks": { "title": "FedRAMP operating runbooks", "description": "Procedures for the security inbox, incident reports, vulnerability detection, evaluation and monthly reporting, and significant change notifications.", "formats": [ "Markdown", "PDF" ], "source_refs": [ "AFC-CSO-INB", "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "VDR-CSO-RES", "VER-TFR-MHR", "SCN-CSO-EVA" ] }, "ocr-kit": { "title": "Ongoing Certification Report and Quarterly Review kit", "description": "Quarterly report template and example, feedback mechanism, and Quarterly Review agenda and registration setup.", "formats": [ "PDF", "JSON" ], "source_refs": [ "CCM-OCR-AVL", "CCM-OCR-FBM", "CCM-QTR-REG" ] }, "secure-configuration-guide": { "title": "Secure Configuration Guide", "description": "Recommended secure settings for the cloud service offering, with instructions in the package for obtaining and using it.", "formats": [ "HTML", "PDF" ], "source_refs": [ "SCG-CSO-RSC", "SCG-CSO-AUP" ] }, "certification-package": { "title": "Certification package", "description": "Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class C rule and Key Security Indicator. Each entry carries an implementation status, the independent assessor's assessment summary, and, where partially or not implemented, the reason and a plan with timeframes. The Security Decision Record also carries historical Key Security Indicator metrics. Includes Key Security Indicator summaries, relevant policies, cryptographic module documentation, and every referenced artifact and piece of evidence, all reachable from the trust center without an NDA or terms of service.", "formats": [ "HTML", "JSON" ], "source_refs": [ "FRC-CSO-PKG", "CPO-CSO-OVR", "SDR-CSO-FRR", "CDS-CSO-IRP", "CMU-CSO-CMD", "IVV-IAS-SUM", "FRC-CSX-VVR" ] }, "sample-reports": { "title": "Sample incident, change, and vulnerability reports", "description": "Filled samples of the Initial, Ongoing, and Final Incident Reports, a Significant Change Notification, and vulnerability reporting with vulnerability details and accepted vulnerability information, plus historical vulnerability detection and response activity, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident, change, or report has occurred.", "formats": [ "HTML", "JSON" ], "source_refs": [ "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "SCN-CSO-INF", "VER-RPT-VDT", "VER-RPT-AVI", "VER-TFR-MRH" ] }, "assessment-support": { "title": "Assessment support", "description": "Evidence of implementation and effectiveness organized for the assessor, technical walkthroughs, and help responding to findings.", "formats": [ "JSON", "PDF" ], "source_refs": [ "IVV-CSO-SEI", "IVV-CSO-SEE", "IVV-CSO-ICP" ] }, "submission-kit": { "title": "Submission kit", "description": "Final validation record, the assessor's overall summary added to the package, and a pre-filled guide for the client's FedRAMP Certification Application Form.", "formats": [ "PDF" ], "source_refs": [ "FRC-APP-FCP", "FRC-APP-FIA", "CPO-CSO-OSA", "IVV-IAS-OSA", "FRC-APP-AFC", "FRC-APP-NTP" ] } }, "cost": { "model": "tiered", "currency": "USD", "price": { "min": 100000, "max": 150000 }, "display": "$100,000 when the client provides GRC tooling, or $150,000 all-in with Sequencer Assurance providing all GRC technology and tooling", "tiers": { "client-tooling": { "title": "Client tooling", "description": "The client provides the GRC technology and tooling, including a FedRAMP-compatible trust center.", "price": { "min": 100000, "max": 100000 }, "includes": [ "The full fixed-scope 20x Class C engagement" ], "source_refs": [ "CDS-CSO-UTC" ] }, "all-in": { "title": "All-in", "description": "Sequencer Assurance provides all GRC technology and tooling, including the trust center.", "price": { "min": 150000, "max": 150000 }, "includes": [ "The full fixed-scope 20x Class C engagement", "All GRC technology and tooling, provided by Sequencer Assurance" ], "source_refs": [ "CDS-CSO-UTC", "CDS-TRC-PAC", "CDS-TRC-ACL", "CDS-TRC-AAI" ] } }, "add_ons": [ { "title": "GRC tools from the client's maturity roadmap", "description": "Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee.", "pricing": "quoted", "requires_client_approval": true } ], "billing": [ { "milestone": "Kickoff", "percent": 50 }, { "milestone": "Independent assessment performed", "percent": 50 } ], "third_party_costs": [ "Independent assessment by a FedRAMP Recognized assessor (required initially and every year)", "Licensing for the client's own GRC tooling and trust center (client tooling tier)" ] }, "inclusions": [ "Gap assessment against all 95 required Class C rules and 46 required Key Security Indicators, plus the optional rules the client already meets", "Authoring of the certification package, public JSON, and Secure Configuration Guide in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator", "Sample incident, significant change, vulnerability, and Ongoing Certification Reports for the package", "A trust center access check so FedRAMP can open every package file without an NDA or terms of service", "A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included", "Design of automated verification and validation for the Security Decision Record's rule entries, which FedRAMP recommends for Class B and C; the client implements it", "Process design for inbox, incident, vulnerability, significant change, and quarterly reporting rules", "Evidence preparation and support during the independent assessment", "Support during FedRAMP review" ], "exclusions": [ "The independent assessment itself, which a separate FedRAMP Recognized assessor performs", "Submitting the application on the client's behalf, which FedRAMP prohibits", "Engineering changes to the client's systems" ], "client_responsibilities": [ "Name a technical owner and an executive sponsor", "Engage and pay a FedRAMP Recognized assessor", "Supply evidence of implementation and effectiveness to the assessor", "Submit the FedRAMP Certification Application Form", { "text": "After handover, keep the package current every 2 weeks, verify machine-based resources every 3 days, report vulnerability activity monthly, and produce the quarterly Ongoing Certification Report and host the Quarterly Review", "source_refs": [ "CPO-CSX-CPM", "VER-TFR-MHR", "CCM-OCR-AVL", "CCM-QTR-MTG" ], "link": { "label": "Drop Sequencer Assurance a note about custom retainers", "url": "https://sequencerassurance.com/contact/" } } ], "coverage": [ { "ref": "FRC-CSO-FCP", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "FRC-CSO-POP", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "readiness" }, { "ref": "MAS-CSO-FLO", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-IIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-MDI", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-TPR", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "CCM-OCR-NRD", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "CDS-CSO-PUB", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "FRC-APP-MLF", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "MKT-CSO-MLR", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "MKT-CSO-PML", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "FRC-CSX-VVK", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CED-RAT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CMT-LMC", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CMT-RMV", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CMT-RVP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CMT-VTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-DFP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-EIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-IBP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-MAT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-OFA", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-RNT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-RVP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-CNA-ULN", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-AAM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-APM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-ELP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-JIT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-SNU", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-IAM-SUS", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-INR-AAR", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-INR-RIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-INR-RPI", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-MLA-ALA", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-MLA-EVC", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-MLA-LET", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-MLA-OSM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-MLA-RVL", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-GIV", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-RES", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-RIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-RSD", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-PIY-RVD", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-RPL-ABO", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-RPL-ARP", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-RPL-RRO", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-RPL-TRC", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SCR-MIT", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SCR-MON", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-ACM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-ASM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-EIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-PRR", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-RUD", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-SIN", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-VCM", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "KSI-SVC-VRI", "source": "fedramp-rules", "force": "MUST", "handled_in": "ksi" }, { "ref": "AFC-CSO-CRA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-EMR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-INB", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-NOC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-RCV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-TFG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-AFS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-AVL", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-FBM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-LSI", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "CCM-QTR-MTG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-QTR-NID", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "CCM-QTR-NRD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-QTR-REG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-AVR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-CBF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-FID", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-FRC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-HAD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-IRP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-RIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-SVC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-UTC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-AAI", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-ACL", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-PAC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-USH", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-UTC-AAD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CMU-CSO-CMD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-DPR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-EFR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-FIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-IIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-OIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCG-CSO-AUP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCG-CSO-RSC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-ADP-NTF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-EVA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-HIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-HRM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-INF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-MAR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NAF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NFP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NIP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-UPD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-DET", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-FAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-RES", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-TFR-MVX", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-TFR-NMV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-AIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-EIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-ELX", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-EPA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-AVI", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-NID", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "VER-RPT-PER", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-VDT", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-TFR-MAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-TFR-MHR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CPO-CSO-MTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-OSA", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-OVR", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSX-CPM", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-JSN", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-MRA", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-PKG", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSO-FRR", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSO-MTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSX-KMT", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSX-KSI", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "IVV-CSO-DUS", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-FIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-ICP", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-SEE", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-SEI", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSX-AIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "FRC-APP-AFC", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-FCP", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-FIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-NTP", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "submission" } ], "related_services": [ { "id": "SVC-FED-C5R", "relationship": "alternative", "note": "Class C on the Rev5 path, including agency sponsorship." }, { "id": "SVC-FED-B20", "relationship": "alternative", "note": "20x Class B, for cloud service offerings that need less assurance." }, { "id": "SVC-FED-CLA", "relationship": "alternative", "note": "Class A can cover agency use for up to 12 months while Class C is underway." } ], "faq": [ { "q": "Should the client pursue Class C on 20x or Rev5?", "a": "20x is FedRAMP's modern approach based primarily on measured outcomes, using Key Security Indicators with automated validation. Rev5 is the legacy approach based primarily on documented plans, using NIST SP 800-53 controls, and is the only type with an agency-sponsored path (FRD-CTY, FRD-CPH). A cloud service offering cannot seek both Program Certification types at once (FRC-CSO-POP)." }, { "q": "Does Class C require Class A or another framework first?", "a": "No. Class C stands on its own independent assessment. A Class A Certification can cover agency use for up to 12 months while Class C is underway (AGU-USE-CLA)." }, { "q": "Is an independent assessor required for Class C?", "a": "Yes. The client needs an assessment by a FedRAMP Recognized assessor completed within 3 months before applying (FRC-APP-FIA), and every year after certification (IVV-CSO-FIA)." }, { "q": "What does the cloud service offering need to keep doing after certification?", "a": "Keep the package current every 2 weeks (CPO-CSX-CPM), report vulnerability activity monthly (VER-TFR-MHR), verify machine-based resources every 3 days (VDR-TFR-MVX), publish a quarterly Ongoing Certification Report (CCM-OCR-AVL), host a Quarterly Review (CCM-QTR-MTG), and complete an annual independent assessment (IVV-CSO-FIA)." }, { "q": "Can Sequencer Assurance submit the FedRAMP application for the client?", "a": "No. FedRAMP prohibits third parties, including assessors, from applying on the client's behalf (FRC-APP-NTP). Sequencer Assurance prepares everything; the client submits." } ], "call_to_action": { "label": "Book a 20x Class C readiness call", "url": "https://sequencerassurance.com/contact/" }, "updated": [ { "date": "2026-10-25", "comment": "Initial draft." }, { "date": "2026-10-25", "comment": "Set to active." } ] }, "SVC-FED-C5R": { "slug": "fedramp-class-c-rev5", "profile": { "type": "Rev5", "paths": [ "Program", "Agency" ], "class": "C" }, "title": "FedRAMP Rev5 Class C Certification", "tagline": "Take a cloud service offering to FedRAMP Rev5 Class C, through FedRAMP or an agency sponsor.", "description": "Sequencer Assurance prepares a cloud service offering for a FedRAMP Rev5 Class C Certification on either path: directly through FedRAMP, or with an agency sponsor. The work covers scope and gap assessment, Marketplace listing, implementation and documentation of the 322 NIST SP 800-53 Rev. 5 controls Class C requires, the FedRAMP operational processes, and a schema-valid certification package. Sequencer Assurance then supports the client through the independent assessment by a FedRAMP Recognized assessor and prepares the package for the client to submit.", "category": "fedramp", "status": "active", "audience": { "for": [ "Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP Rev5 Class C certification", "Cloud service offerings with an agency sponsor ready to issue an Authorization to Operate", "Cloud service offerings with FedRAMP Ready status that must convert to a FedRAMP Certification", "Cloud service offerings with a Class A or Class B Certification that need Class C" ], "not_for": [ "Cloud service offerings whose only government use is meeting other compliance programs such as CMMC", "Cloud service offerings pursuing a FedRAMP 20x Program Certification", "Cloud service offerings that need a Class B or Class D Certification" ] }, "eligibility": [ { "requirement": "A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly.", "blocking": true, "source_refs": [ "MKT-IIP-AGU", "MKT-FRP-SOF" ] }, { "requirement": "Not concurrently seeking a FedRAMP 20x Program Certification for the same cloud service offering.", "blocking": true, "source_refs": [ "FRC-CSO-POP" ] }, { "requirement": "Budget for an independent assessment by a FedRAMP Recognized assessor, initially and every year after certification.", "blocking": true, "source_refs": [ "FRC-APP-FIA", "IVV-CSO-FIA" ] }, { "requirement": "Agency path only: the sponsoring agency completes its Authorization to Operate and sends the signed ATO letter to FedRAMP.", "blocking": true, "source_refs": [ "FRC-APS-ATO" ] }, { "requirement": "An existing FedRAMP Ready status, Class A Certification, SOC 2 Type II, or GovRAMP assessment shortens the work but is not required.", "blocking": false } ], "outcomes": [ "A FedRAMP Marketplace listing with public human-readable and JSON information about the cloud service offering", "Implementation and documentation of all 322 NIST SP 800-53 Rev. 5 controls required for Class C, with every organization-defined parameter assigned", "Running FedRAMP processes: security inbox, incident reporting, monthly vulnerability reporting, significant change notifications, quarterly Ongoing Certification Reports, and Quarterly Reviews", "A complete, schema-valid certification package that includes the independent assessment results, ready for the client to submit", "A Security Decision Record that addresses every MUST and SHOULD Class C rule and control with an accurate implementation status, the independent assessor's summary for each, and timeframed plans for anything not yet fully implemented", "Package files FedRAMP can open from the trust center without an NDA or terms of service, so the package clears FedRAMP's pre-queue verification and enters the Review Queue sooner" ], "timeline": { "summary": "About 4 to 8 weeks of Sequencer Assurance and client work, plus the independent assessment. Marketplace listing and the operational build-out run alongside control implementation and documentation.", "total": { "min": 4, "max": 8, "unit": "weeks", "estimate": true, "note": "Critical path through the phases, rounded up to whole weeks; build.py checks it." }, "client_effort": { "min": 20, "max": 60, "unit": "hours", "estimate": true, "note": "Spread across the engagement." }, "footnote": "Estimates cover Sequencer Assurance and client work only. Time for the independent assessment, which the assessor schedules, and for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by the assessor, FedRAMP, or GSA.", "phases": { "readiness": { "order": 1, "title": "Scope and gap assessment", "description": "Confirm the Rev5 Class C certification profile and path, define the Minimum Assessment Scope with information flows and third-party resources, and measure the gap against every Class C rule and control.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "owner": "sequencer-assurance", "deliverables": [ "gap-report" ] }, "marketplace": { "order": 2, "title": "Marketplace listing", "description": "Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing.", "duration": { "min": 1, "max": 1, "unit": "days" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "public-info" ] }, "controls": { "order": 3, "title": "Control implementation and documentation", "description": "Close gaps in the 322 required controls, assign every organization-defined parameter, and document each control following FedRAMP Rev5 Controls Guidance.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "control-documentation" ] }, "operations": { "order": 4, "title": "FedRAMP operational build-out", "description": "Stand up the security inbox, incident reporting, vulnerability detection and monthly reporting, significant change notifications, Ongoing Certification Reports and Quarterly Reviews, availability reporting, the trust center, the Secure Configuration Guide, and cryptographic module documentation.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "readiness" ], "owner": "shared", "deliverables": [ "runbooks", "ocr-kit", "secure-configuration-guide" ] }, "package": { "order": 5, "title": "Certification package authoring", "description": "Write the Certification Package Overview and Security Decision Record, including control summaries, parameter assignments, and relevant policies, in human-readable and JSON form validated against FedRAMP's schemas.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "controls", "operations", "marketplace" ], "owner": "sequencer-assurance", "deliverables": [ "certification-package", "sample-reports" ] }, "assessment": { "order": 6, "title": "Independent assessment", "description": "A FedRAMP Recognized assessor verifies and validates the cloud service offering. Sequencer Assurance provides independent assessment support: evidence preparation, technical walkthroughs, and help responding to findings.", "duration": { "min": null, "max": null, "unit": "weeks", "note": "Scheduled by the assessor; not included in the estimate." }, "depends_on": [ "package" ], "owner": "assessor", "deliverables": [ "assessment-support" ] }, "submission": { "order": 7, "title": "Final validation and client submission", "description": "Add the assessment summary to the package, re-verify it against the live cloud service offering, then the client submits the FedRAMP Certification Application within 3 months of the assessment. On the agency path, the sponsoring agency also sends its signed ATO letter to FedRAMP.", "duration": { "min": 1, "max": 2, "unit": "weeks" }, "depends_on": [ "assessment" ], "owner": "client", "deliverables": [ "submission-kit" ] }, "fedramp-review": { "order": 8, "title": "FedRAMP review", "description": "FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review.", "duration": { "min": null, "max": null, "unit": "weeks", "note": "Set by FedRAMP; not published in the rules dataset." }, "depends_on": [ "submission" ], "owner": "fedramp" } }, "clocks": [ { "name": "Assessment freshness", "description": "The independent assessment must have been completed by a FedRAMP Recognized assessor within the previous 3 months at application.", "window": { "min": null, "max": 3, "unit": "months", "estimate": false }, "source_refs": [ "FRC-APP-FIA" ] }, { "name": "Package freshness", "description": "The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days.", "window": { "min": null, "max": 7, "unit": "days", "estimate": false }, "source_refs": [ "FRC-APP-FCP" ] }, { "name": "Marketplace assessment deadline", "description": "An assessment for Class B, C, or D must be scheduled within 2 years of the initial Marketplace listing, or FedRAMP removes the listing.", "window": { "min": null, "max": 2, "unit": "years", "estimate": false }, "source_refs": [ "MKT-IIP-DLA" ] }, { "name": "FedRAMP Ready conversion", "description": "Cloud service offerings with FedRAMP Ready status must convert to a FedRAMP Certification by November 17, 2026 or the expiration of their annual assessment, whichever is later.", "window": { "min": null, "max": null, "unit": "days", "estimate": false, "note": "Fixed date: November 17, 2026, or annual assessment expiry if later" }, "source_refs": [ "FRC-CSF-RDY" ] } ] }, "deliverables": { "gap-report": { "title": "Class C gap report", "description": "Status of every Class C rule and control against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record.", "formats": [ "PDF", "JSON" ], "source_refs": [ "FRC-CSO-FCP", "MAS-CSO-IIR", "MAS-CSO-FLO", "MAS-CSO-TPR" ] }, "public-info": { "title": "Public cloud service offering information", "description": "Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report and review dates.", "formats": [ "HTML", "JSON" ], "source_refs": [ "CDS-CSO-PUB", "CDS-CSO-SVC", "CCM-OCR-NRD", "CCM-QTR-NRD" ] }, "control-documentation": { "title": "Control implementation documentation", "description": "Implementation summaries for the 322 required controls and the organization-defined parameter assignments.", "formats": [ "JSON", "Markdown" ], "source_refs": [ "FRC-CSF-BSL", "FRC-CSF-ACP", "FRC-CSF-FFG", "SDR-CSF-CTF" ] }, "runbooks": { "title": "FedRAMP operating runbooks", "description": "Procedures for the security inbox, incident reports, vulnerability detection, evaluation and monthly reporting, and significant change notifications.", "formats": [ "Markdown", "PDF" ], "source_refs": [ "AFC-CSO-INB", "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "VDR-CSO-RES", "VER-TFR-MHR", "SCN-CSO-EVA" ] }, "ocr-kit": { "title": "Ongoing Certification Report and Quarterly Review kit", "description": "Quarterly report template and example, feedback mechanism, and Quarterly Review agenda and registration setup.", "formats": [ "PDF", "JSON" ], "source_refs": [ "CCM-OCR-AVL", "CCM-OCR-FBM", "CCM-QTR-REG" ] }, "secure-configuration-guide": { "title": "Secure Configuration Guide", "description": "Recommended secure settings for the cloud service offering, with instructions in the package for obtaining and using it.", "formats": [ "HTML", "PDF" ], "source_refs": [ "SCG-CSO-RSC", "SCG-CSO-AUP" ] }, "certification-package": { "title": "Certification package", "description": "Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class C rule and control. Each entry carries an implementation status, the independent assessor's assessment summary, and, where partially or not implemented, the reason and a plan with timeframes. Includes control summaries, relevant policies, cryptographic module documentation, and every referenced artifact and piece of evidence, all reachable from the trust center without an NDA or terms of service.", "formats": [ "HTML", "JSON" ], "source_refs": [ "FRC-CSO-PKG", "CPO-CSO-OVR", "SDR-CSO-FRR", "CDS-CSO-IRP", "CMU-CSO-CMD", "IVV-IAS-SUM" ] }, "sample-reports": { "title": "Sample incident, change, and vulnerability reports", "description": "Filled samples of the Initial, Ongoing, and Final Incident Reports, a Significant Change Notification, and vulnerability reporting with vulnerability details and accepted vulnerability information, plus historical vulnerability detection and response activity, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident, change, or report has occurred.", "formats": [ "HTML", "JSON" ], "source_refs": [ "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "SCN-CSO-INF", "VER-RPT-VDT", "VER-RPT-AVI", "VER-TFR-MRH" ] }, "assessment-support": { "title": "Assessment support", "description": "Evidence of implementation and effectiveness organized for the assessor, technical walkthroughs, and help responding to findings.", "formats": [ "JSON", "PDF" ], "source_refs": [ "IVV-CSO-SEI", "IVV-CSO-SEE", "IVV-CSO-ICP" ] }, "submission-kit": { "title": "Submission kit", "description": "Final validation record, the assessor's overall summary added to the package, and a pre-filled guide for the client's FedRAMP Certification Application Form.", "formats": [ "PDF" ], "source_refs": [ "FRC-APP-FCP", "FRC-APP-FIA", "CPO-CSO-OSA", "IVV-IAS-OSA", "FRC-APP-AFC", "FRC-APP-NTP", "FRC-APS-ATO" ] } }, "cost": { "model": "tiered", "currency": "USD", "display": "$150,000 all-in with Sequencer Assurance providing all GRC technology and tooling, or a custom quote when the client provides GRC tooling", "tiers": { "client-tooling": { "title": "Client tooling", "description": "The client provides the GRC technology and tooling, including a FedRAMP-compatible trust center. Priced per client because tooling varies widely.", "pricing": "quoted", "price": { "min": null, "max": null }, "includes": [ "The full fixed-scope Rev5 Class C engagement" ], "source_refs": [ "CDS-CSO-UTC" ] }, "all-in": { "title": "All-in", "description": "Sequencer Assurance provides all GRC technology and tooling, including the trust center.", "price": { "min": 150000, "max": 150000 }, "includes": [ "The full fixed-scope Rev5 Class C engagement", "All GRC technology and tooling, provided by Sequencer Assurance" ], "source_refs": [ "CDS-CSO-UTC", "CDS-TRC-PAC", "CDS-TRC-ACL", "CDS-TRC-AAI" ] } }, "add_ons": [ { "title": "GRC tools from the client's maturity roadmap", "description": "Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee.", "pricing": "quoted", "requires_client_approval": true } ], "billing": [ { "milestone": "Kickoff", "percent": 50 }, { "milestone": "Independent assessment performed", "percent": 50 } ], "third_party_costs": [ "Independent assessment by a FedRAMP Recognized assessor (required initially, then 35 named controls every year and all controls every 3 years)", "Licensing for the client's own GRC tooling and trust center (client tooling tier)" ] }, "inclusions": [ "Gap assessment against all 101 required Class C rules and 322 required controls, plus the optional rules the client already meets", "Control documentation, the certification package, public JSON, and the Secure Configuration Guide in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator", "Sample incident, significant change, vulnerability, and Ongoing Certification Reports for the package", "A trust center access check so FedRAMP can open every package file without an NDA or terms of service", "A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included", "Process design for inbox, incident, vulnerability, significant change, and quarterly reporting rules", "Evidence preparation and support during the independent assessment", "Support during FedRAMP review" ], "exclusions": [ "The independent assessment itself, which a separate FedRAMP Recognized assessor performs", "The sponsoring agency's Authorization to Operate process on the agency path", "Submitting the application on the client's behalf, which FedRAMP prohibits", "Engineering changes to the client's systems" ], "client_responsibilities": [ "Name a technical owner and an executive sponsor", "Agency path: coordinate the Authorization to Operate with the sponsoring agency", "Engage and pay a FedRAMP Recognized assessor", "Supply evidence of implementation and effectiveness to the assessor", "Submit the FedRAMP Certification Application Form", { "text": "After handover, keep the package current at least yearly, verify machine-based resources monthly, report vulnerability activity monthly, produce the quarterly Ongoing Certification Report and host the Quarterly Review, and include previously failed controls in the next assessment", "source_refs": [ "CPO-CSF-CPM", "VDR-TFR-MVF", "VER-TFR-MHR", "CCM-OCR-AVL", "CCM-QTR-MTG", "IVV-CSF-ACF" ], "link": { "label": "Drop Sequencer Assurance a note about custom retainers", "url": "https://sequencerassurance.com/contact/" } } ], "coverage": [ { "ref": "FRC-CSF-RDY", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "FRC-CSO-FCP", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "FRC-CSO-POP", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "readiness" }, { "ref": "MAS-CSO-FLO", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-IIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-MDI", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "MAS-CSO-TPR", "source": "fedramp-rules", "force": "MUST", "handled_in": "readiness" }, { "ref": "CCM-OCR-NRD", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "CDS-CSO-PUB", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "FRC-APP-MLF", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "MKT-CSO-MLR", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "MKT-CSO-PML", "source": "fedramp-rules", "force": "MUST", "handled_in": "marketplace" }, { "ref": "FRC-CSF-ACP", "source": "fedramp-rules", "force": "MUST", "handled_in": "controls" }, { "ref": "FRC-CSF-BSL", "source": "fedramp-rules", "force": "MUST", "handled_in": "controls" }, { "ref": "FRC-CSF-FFG", "source": "fedramp-rules", "force": "MUST", "handled_in": "controls" }, { "ref": "AFC-CSO-CRA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-EMR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-INB", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-NOC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-RCV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "AFC-CSO-TFG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-AFS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-AVL", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-FBM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-OCR-LSI", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "CCM-QTR-MTG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-QTR-NID", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "CCM-QTR-NRD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CCM-QTR-REG", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSF-TCM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-AVR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-CBF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-FID", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-FRC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-HAD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-IRP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-RIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-SVC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-CSO-UTC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-AAI", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-ACL", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-PAC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-TRC-USH", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CDS-UTC-AAD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CMU-CSO-CMD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-DPR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-EFR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-FIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-IIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "IEC-CSO-OIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCG-CSO-AUP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCG-CSO-RSC", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-ADP-NTF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-EVA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-HIS", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-HRM", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-INF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-CSO-MAR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NAF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NFP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-NIP", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "SCN-TRF-UPD", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-DET", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-FAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-CSO-RES", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-TFR-MVF", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VDR-TFR-NMV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-AIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-EIR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-ELX", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-EVA-EPA", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-AVI", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-NID", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "operations" }, { "ref": "VER-RPT-PER", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-RPT-VDT", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-TFR-MAV", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "VER-TFR-MHR", "source": "fedramp-rules", "force": "MUST", "handled_in": "operations" }, { "ref": "CPO-CSF-CPM", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-MTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-OSA", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "CPO-CSO-OVR", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-JSN", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-MRA", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "FRC-CSO-PKG", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSF-CTF", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSO-FRR", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "SDR-CSO-MTD", "source": "fedramp-rules", "force": "MUST", "handled_in": "package" }, { "ref": "IVV-CSF-ACF", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSF-AIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSF-MCA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-DUS", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-FIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-ICP", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-SEE", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "IVV-CSO-SEI", "source": "fedramp-rules", "force": "MUST", "handled_in": "assessment" }, { "ref": "FRC-APP-AFC", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-FCP", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-FIA", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" }, { "ref": "FRC-APP-NTP", "source": "fedramp-rules", "force": "MUST NOT", "handled_in": "submission" }, { "ref": "FRC-APS-ATO", "source": "fedramp-rules", "force": "MUST", "handled_in": "submission" } ], "related_services": [ { "id": "SVC-FED-C20", "relationship": "alternative", "note": "Class C on the 20x path, using Key Security Indicators." }, { "id": "SVC-FED-B5R", "relationship": "alternative", "note": "Rev5 Class B, for cloud service offerings that need less assurance." }, { "id": "SVC-FED-CLA", "relationship": "alternative", "note": "Class A can cover agency use for up to 12 months while Class C is underway." } ], "faq": [ { "q": "Should the client pursue Class C on 20x or Rev5?", "a": "20x is FedRAMP's modern approach based primarily on measured outcomes, using Key Security Indicators with automated validation. Rev5 is the legacy approach based primarily on documented plans, using NIST SP 800-53 controls, and is the only type with an agency-sponsored path (FRD-CTY, FRD-CPH). A cloud service offering cannot seek both Program Certification types at once (FRC-CSO-POP)." }, { "q": "What is the difference between the Program and Agency paths?", "a": "On the Program path, FedRAMP certifies the cloud service offering directly. On the Agency path, a sponsoring agency completes its own Authorization to Operate and sends the signed ATO letter to FedRAMP, which still reviews and approves the certification (FRD-CPH, FRC-APS-ATO)." }, { "q": "When do the Rev5 rules become required?", "a": "New Rev5 certifications must follow these rules from January 1, 2027. They can be adopted now." }, { "q": "Is an independent assessor required for Class C?", "a": "Yes. The client needs an assessment by a FedRAMP Recognized assessor completed within 3 months before applying (FRC-APP-FIA). After certification, 80 named controls are assessed every year and all controls at least every 3 years (IVV-CSF-AIA, IVV-CSF-MCA)." }, { "q": "Can Sequencer Assurance submit the FedRAMP application for the client?", "a": "No. FedRAMP prohibits third parties, including assessors, from applying on the client's behalf (FRC-APP-NTP). Sequencer Assurance prepares everything; the client submits." } ], "call_to_action": { "label": "Book a Rev5 Class C readiness call", "url": "https://sequencerassurance.com/contact/" }, "updated": [ { "date": "2026-10-25", "comment": "Initial draft." }, { "date": "2026-10-25", "comment": "Set to active." } ] } } }