FedRAMP 20x Class A Certification

How much does FedRAMP 20x Class A cost?

$15,000 flat with the client's trust center, or $20,000 with a Sequencer Assurance trust center MVP.

• Client trust center: $15,000. The client brings an existing FedRAMP-compatible trust center. (CDS-CSO-UTC)
  • The full fixed-scope Class A engagement
• Trust center MVP: $20,000. Sequencer Assurance provides a trust center MVP that meets the Class A requirements. (CDS-CSO-UTC, CDS-CSO-PUB)
  • The full fixed-scope Class A engagement
  • A trust center MVP provided by Sequencer Assurance

How is it billed?

• 50% at Kickoff
• 50% at Package ready for submission

Optional add-ons

• GRC tools from the client's maturity roadmap (quoted separately). Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee. Requires client approval before purchase.

What costs are outside the fee?

• Alternative framework audits (SOC 2, GovRAMP)
• Licensing for the client's own trust center (client trust center tier)
• Optional FedRAMP Recognized independent assessor

How long does FedRAMP 20x Class A take?

About 2 to 5 weeks from kickoff to a submitted application, depending on how many FedRAMP-specific processes already exist. Marketplace listing runs alongside the operational build-out.

Total: 2–5 weeks (estimate).

Client time: 5–10 hours in total. Spread across the 2 to 5 weeks.

Phases

1. Eligibility and gap assessment (1–7 days; owner: Sequencer Assurance). Confirm the alternative framework assessment qualifies and is inside its 12-month window, define the assessment scope, and measure the gap against every mandatory Class A rule. Deliverables: Class A gap report.
2. Marketplace listing (1 day; owner: Shared). Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing. Deliverables: Public cloud service offering information.
3. FedRAMP operational build-out (1–2 weeks; owner: Shared). Stand up the FedRAMP security inbox, incident reportability and final reporting, vulnerability detection, the trust center, the quarterly report process, and evidence for the seven required Key Security Indicators. Deliverables: FedRAMP operating runbooks, Ongoing Certification Report template and example.
4. Certification package authoring (1–7 days; owner: Sequencer Assurance). Write the Certification Package Overview and Security Decision Record in human-readable and JSON form, validate them against FedRAMP's schemas, and confirm public JSON is served with correct CORS and headers. Deliverables: Certification package, Sample incident and vulnerability reports.
5. Final validation and client submission (1–7 days; owner: Client). Re-verify the package against the live cloud service offering, then the client submits the FedRAMP Certification Application. FedRAMP does not accept third-party applications, so Sequencer Assurance prepares the package and the client submits it. Deliverables: Submission kit.
6. FedRAMP review (Set by FedRAMP; not published in the rules dataset; owner: FedRAMP). FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review.

Estimates cover Sequencer Assurance and client work only. Time for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by FedRAMP or GSA.

What deadlines do the FedRAMP rules set?

• Alternative framework freshness (up to 12 months): The SOC 2, GovRAMP, or FedRAMP Rev5 assessment must have been completed within the past 12 months at application. (FRC-CLA-ASF)
• Package freshness (up to 7 days): The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days. (FRC-APP-FCP)
• Class A agency use window (up to 12 months): Agencies should not use a Class A cloud service offering for more than 12 months unless it is actively seeking Class B, C, or D. (AGU-USE-CLA)

Who is FedRAMP 20x Class A for?

• Cloud service offerings sold, or about to be sold, to US federal agencies directly or as a component of another cloud service offering
• Cloud service offerings with a SOC 2 Type II, GovRAMP, or FedRAMP Rev5 assessment completed in the last 12 months

Who is it not for?

• Cloud service offerings whose only government use is meeting other compliance programs such as CMMC
• Cloud service offerings that need a Rev5 Program Certification or an agency-sponsored path
• Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP 20x Class B, C, or D certification

Who is eligible for FedRAMP 20x Class A?

• Required: A certification or equivalent from SOC 2 Type II, GovRAMP (any impact level), or FedRAMP Rev5 / FedRAMP Ready (any impact level), completed within the past 12 months. (FRC-CLA-ASF)
• Required: A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly. (MKT-IIP-AGU, MKT-FRP-SOF)
• Required: Not concurrently seeking a FedRAMP Rev5 Program Certification for the same cloud service offering. (FRC-CSO-POP)

What does the client get from FedRAMP 20x Class A?

• A FedRAMP Marketplace listing with public human-readable and JSON information about the cloud service offering
• A complete, schema-valid 20x Class A certification package, freshly validated and ready to submit
• A Security Decision Record that addresses every MUST and SHOULD Class A rule and Key Security Indicator with an accurate implementation status, a direct alternative framework mapping or linked artifact, and timeframed plans for anything not yet fully implemented
• Package files FedRAMP can open from the trust center without an NDA or terms of service, so the package clears FedRAMP's pre-queue verification and enters the Review Queue sooner
• Running FedRAMP processes: security inbox, incident reporting, vulnerability detection, and quarterly Ongoing Certification Reports
• A plan toward Class B, C, or D, since agencies should not use a Class A cloud service offering for more than 12 months without one

What are the deliverables?

• Class A gap report (PDF, JSON): Status of each mandatory, recommended, and optional Class A rule against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record. (FRC-CLA-MFR, FRC-CLA-RFR, FRC-CLA-OFR)
• Public cloud service offering information (HTML, JSON): Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report date. (CDS-CSO-PUB, CCM-OCR-NRD, FRC-CSO-JSN)
• FedRAMP operating runbooks (Markdown, PDF): Procedures for the FedRAMP security inbox, emergency actions, incident reportability, final incident reports, and vulnerability detection. (AFC-CSO-INB, AFC-CSO-RCV, AFC-CSO-CRA, IEC-CSO-EFR, IEC-CSO-FIR, VDR-CSO-DET)
• Ongoing Certification Report template and example (PDF, JSON): A quarterly report template plus a filled example for the package. (CCM-OCR-AVL)
• Certification package (HTML, JSON): Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class A rule and Key Security Indicator. Each entry carries an implementation status, a direct alternative framework mapping (a specific criterion such as CC8.1, or a page and section, never just the report as a whole) or a linked artifact, and, where partially or not implemented, the reason and a plan with timeframes. Includes the alternative framework materials (such as the SOC 2 Type II report and bridge letter) and every referenced artifact, all reachable from the trust center without an NDA or terms of service, plus the independent assessor's summaries when the client opts for independent verification and validation. (FRC-CSO-PKG, FRC-CLA-EAM, CPO-CSO-OVR, SDR-CSO-FRR)
• Sample incident and vulnerability reports (HTML, JSON): Filled samples of the Initial, Ongoing, and Final Incident Reports, plus historical vulnerability detection and response activity when that rule is in the Security Decision Record, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident has occurred. (IEC-CSO-IIR, IEC-CSO-OIR, IEC-CSO-FIR, VER-TFR-MRH)
• Submission kit (PDF): Final validation record and a pre-filled guide for the client's FedRAMP Certification Application Form. (FRC-APP-FCP, FRC-APP-AFC, FRC-APP-NTP)

What is included?

• Gap assessment against all 23 mandatory Class A rules and indicators, plus the recommended rules the Security Decision Record must also address and the optional rules the client already meets
• Authoring of the certification package and public JSON in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator
• Direct alternative framework mappings and linked artifacts for every rule and Key Security Indicator
• Sample incident, vulnerability activity, and Ongoing Certification Reports for the package
• A trust center access check so FedRAMP can open every package file without an NDA or terms of service
• A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included
• Process design for inbox, incident, vulnerability, and quarterly reporting rules
• Support during FedRAMP review

What is not included?

• The underlying SOC 2, GovRAMP, or FedRAMP Rev5 audit
• Submitting the application on the client's behalf, which FedRAMP prohibits
• Engineering changes to the client's systems

What does the client need to do?

• Supply the alternative framework report and supporting materials
• Name a technical owner and an executive sponsor
• Operate the FedRAMP security inbox and incident processes once handed over
• Submit the FedRAMP Certification Application Form
• Produce the quarterly Ongoing Certification Report every 3 months after handover (CCM-OCR-AVL). Drop Sequencer Assurance a note about custom retainers

Frequently asked questions

Which FedRAMP rules does FedRAMP 20x Class A cover?

Each rule, its force, and the phase where Sequencer Assurance handles it.

Related services

• FedRAMP 20x Class B Certification: Agencies expect Class A offerings to pursue Class B, C, or D within 12 months.
• FedRAMP Rev5 Class B Certification: Class B on the Rev5 path, through FedRAMP or an agency sponsor.
• FedRAMP 20x Class C Certification: Class C on the 20x path.
• FedRAMP Rev5 Class C Certification: Class C on the Rev5 path, through FedRAMP or an agency sponsor.