# FedRAMP 20x Class A Certification - ID: SVC-FED-CLA - FedRAMP profile: 20x, Program path, Class A - Status: active - Page: https://sequencerassurance.com/services/fedramp-class-a/ Sequencer Assurance takes a cloud service offering that already holds a recent SOC 2 Type II, GovRAMP, or FedRAMP Rev5 assessment and prepares everything FedRAMP requires for a 20x Class A Certification: scope, Marketplace listing, the FedRAMP-specific operational processes, the seven required Key Security Indicators, and a schema-valid certification package ready for the client to submit. ## Who it is for - Cloud service offerings sold, or about to be sold, to US federal agencies directly or as a component of another cloud service offering - Cloud service offerings with a SOC 2 Type II, GovRAMP, or FedRAMP Rev5 assessment completed in the last 12 months ## Who it is not for - Cloud service offerings whose only government use is meeting other compliance programs such as CMMC - Cloud service offerings that need a Rev5 Program Certification or an agency-sponsored path - Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP 20x Class B, C, or D certification ## Eligibility - Required: A certification or equivalent from SOC 2 Type II, GovRAMP (any impact level), or FedRAMP Rev5 / FedRAMP Ready (any impact level), completed within the past 12 months. (FRC-CLA-ASF) - Required: A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly. (MKT-IIP-AGU, MKT-FRP-SOF) - Required: Not concurrently seeking a FedRAMP Rev5 Program Certification for the same cloud service offering. (FRC-CSO-POP) ## Timeline About 2 to 5 weeks from kickoff to a submitted application, depending on how many FedRAMP-specific processes already exist. Marketplace listing runs alongside the operational build-out. Total: 2–5 weeks (estimate). Client time: 5–10 hours total, spread across the 2 to 5 weeks. 1. Eligibility and gap assessment (1–7 days; owner: sequencer-assurance): Confirm the alternative framework assessment qualifies and is inside its 12-month window, define the assessment scope, and measure the gap against every mandatory Class A rule. 2. Marketplace listing (1 day; owner: shared): Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing. 3. FedRAMP operational build-out (1–2 weeks; owner: shared): Stand up the FedRAMP security inbox, incident reportability and final reporting, vulnerability detection, the trust center, the quarterly report process, and evidence for the seven required Key Security Indicators. 4. Certification package authoring (1–7 days; owner: sequencer-assurance): Write the Certification Package Overview and Security Decision Record in human-readable and JSON form, validate them against FedRAMP's schemas, and confirm public JSON is served with correct CORS and headers. 5. Final validation and client submission (1–7 days; owner: client): Re-verify the package against the live cloud service offering, then the client submits the FedRAMP Certification Application. FedRAMP does not accept third-party applications, so Sequencer Assurance prepares the package and the client submits it. 6. FedRAMP review (Set by FedRAMP; not published in the rules dataset; owner: fedramp): FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review. Note: Estimates cover Sequencer Assurance and client work only. Time for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by FedRAMP or GSA. Deadlines set by the rules: - Alternative framework freshness: The SOC 2, GovRAMP, or FedRAMP Rev5 assessment must have been completed within the past 12 months at application. (FRC-CLA-ASF) - Package freshness: The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days. (FRC-APP-FCP) - Class A agency use window: Agencies should not use a Class A cloud service offering for more than 12 months unless it is actively seeking Class B, C, or D. (AGU-USE-CLA) ## Cost $15,000 flat with the client's trust center, or $20,000 with a Sequencer Assurance trust center MVP. Pricing model: tiered. Range: $15,000–$20,000. - Client trust center: $15,000. The client brings an existing FedRAMP-compatible trust center. - Trust center MVP: $20,000. Sequencer Assurance provides a trust center MVP that meets the Class A requirements. - 50% at Kickoff - 50% at Package ready for submission - Add-on, quoted separately: GRC tools from the client's maturity roadmap. Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee. Requires client approval before purchase. ## Deliverables - Class A gap report [PDF, JSON]: Status of each mandatory, recommended, and optional Class A rule against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record. - Public cloud service offering information [HTML, JSON]: Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report date. - FedRAMP operating runbooks [Markdown, PDF]: Procedures for the FedRAMP security inbox, emergency actions, incident reportability, final incident reports, and vulnerability detection. - Ongoing Certification Report template and example [PDF, JSON]: A quarterly report template plus a filled example for the package. - Certification package [HTML, JSON]: Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class A rule and Key Security Indicator. Each entry carries an implementation status, a direct alternative framework mapping (a specific criterion such as CC8.1, or a page and section, never just the report as a whole) or a linked artifact, and, where partially or not implemented, the reason and a plan with timeframes. Includes the alternative framework materials (such as the SOC 2 Type II report and bridge letter) and every referenced artifact, all reachable from the trust center without an NDA or terms of service, plus the independent assessor's summaries when the client opts for independent verification and validation. - Sample incident and vulnerability reports [HTML, JSON]: Filled samples of the Initial, Ongoing, and Final Incident Reports, plus historical vulnerability detection and response activity when that rule is in the Security Decision Record, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident has occurred. - Submission kit [PDF]: Final validation record and a pre-filled guide for the client's FedRAMP Certification Application Form. ## Included - Gap assessment against all 23 mandatory Class A rules and indicators, plus the recommended rules the Security Decision Record must also address and the optional rules the client already meets - Authoring of the certification package and public JSON in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator - Direct alternative framework mappings and linked artifacts for every rule and Key Security Indicator - Sample incident, vulnerability activity, and Ongoing Certification Reports for the package - A trust center access check so FedRAMP can open every package file without an NDA or terms of service - A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included - Process design for inbox, incident, vulnerability, and quarterly reporting rules - Support during FedRAMP review ## Not included - The underlying SOC 2, GovRAMP, or FedRAMP Rev5 audit - Submitting the application on the client's behalf, which FedRAMP prohibits - Engineering changes to the client's systems ## Client responsibilities - Supply the alternative framework report and supporting materials - Name a technical owner and an executive sponsor - Operate the FedRAMP security inbox and incident processes once handed over - Submit the FedRAMP Certification Application Form - Produce the quarterly Ongoing Certification Report every 3 months after handover (CCM-OCR-AVL). [Drop Sequencer Assurance a note about custom retainers](https://sequencerassurance.com/contact/) ## Rules covered | Rule | Force | Phase | | --- | --- | --- | | FRC-CLA-ASF | MUST | readiness | | FRC-CLA-EAM | MUST | package | | FRC-CSO-POP | MUST NOT | readiness | | MAS-CSO-IIR | MUST | readiness | | CDS-CSO-PUB | MUST | marketplace | | CCM-OCR-NRD | MUST | marketplace | | CDS-CSO-UTC | MUST | operations | | CDS-UTC-AAD | MUST | operations | | AFC-CSO-INB | MUST | operations | | AFC-CSO-RCV | MUST | operations | | AFC-CSO-CRA | MUST | operations | | IEC-CSO-EFR | MUST | operations | | IEC-CSO-FIR | MUST | operations | | VDR-CSO-DET | MUST | operations | | CCM-OCR-AVL | MUST | operations | | IVV-CSX-AIA | MUST | operations | | KSI-CMT-LMC | MUST | operations | | KSI-CNA-RNT | MUST | operations | | KSI-CED-RAT | MUST | operations | | KSI-IAM-AAM | MUST | operations | | KSI-IAM-APM | MUST | operations | | KSI-INR-RIR | MUST | operations | | KSI-SVC-SIN | MUST | operations | | FRC-CSO-PKG | MUST | package | | FRC-CSO-JSN | MUST | package | | FRC-APP-MLF | MUST | marketplace | | FRC-APP-FCP | MUST | submission | | FRC-APP-AFC | MUST | submission | ## FAQ **Can Sequencer Assurance submit the FedRAMP application for the client?** No. FedRAMP prohibits third parties, including assessors, from applying on the client's behalf (FRC-APP-NTP). Sequencer Assurance prepares everything; the client submits. **Is an independent FedRAMP assessor required for Class A?** No. It is optional for Class A (FRC-CLA-IVV). Your SOC 2, GovRAMP, or FedRAMP Rev5 assessment carries the independent assessment. **How long can agencies rely on Class A?** Agencies should not use a Class A cloud service offering for more than 12 months unless it is actively pursuing Class B, C, or D (AGU-USE-CLA). Services menu version 1.0.0, updated 2026-10-25; FedRAMP rules checked against FedRAMP Consolidated Rules for 2026, version 2026.10.13.01.