# FedRAMP 20x Class B Certification

- ID: SVC-FED-B20
- FedRAMP profile: 20x, Program path, Class B
- Status: active
- Page: https://sequencerassurance.com/services/fedramp-class-b-20x/

Sequencer Assurance prepares a cloud service offering for a FedRAMP 20x Class B Certification: scope and gap assessment, Marketplace listing, implementation evidence for every required Key Security Indicator, the FedRAMP operational processes Class B requires, and a schema-valid certification package. Sequencer Assurance then supports the client through the independent assessment by a FedRAMP Recognized assessor and prepares the package for the client to submit.

## Who it is for

- Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP 20x Class B certification
- Cloud service offerings with a Class A Certification that agencies expect to move to Class B within 12 months
- Cloud service offerings sold, or about to be sold, to US federal agencies directly or as a component of another cloud service offering

## Who it is not for

- Cloud service offerings whose only government use is meeting other compliance programs such as CMMC
- Cloud service offerings that need a Rev5 Program Certification or an agency-sponsored path
- Cloud service offerings that need a Class C or Class D Certification

## Eligibility

- Required: A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly. (MKT-IIP-AGU, MKT-FRP-SOF)
- Required: Not concurrently seeking a FedRAMP Rev5 Program Certification for the same cloud service offering. (FRC-CSO-POP)
- Required: Budget for an independent assessment by a FedRAMP Recognized assessor, initially and every year after certification. (FRC-APP-FIA, IVV-CSO-FIA)
- Preferred: An existing Class A Certification, SOC 2 Type II, or GovRAMP assessment shortens the work but is not required.

## Timeline

About 5 to 10 weeks of Sequencer Assurance and client work, plus the independent assessment. Marketplace listing and the operational build-out run alongside Key Security Indicator implementation.

Total: 5–10 weeks (estimate).

Client time: 20–60 hours total, spread across the engagement.

1. Scope and gap assessment (1–2 weeks; owner: sequencer-assurance): Confirm the Class B certification profile, define the Minimum Assessment Scope with information flows and third-party resources, and measure the gap against every Class B rule and Key Security Indicator.
2. Marketplace listing (1 day; owner: shared): Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing.
3. Key Security Indicator implementation (2–4 weeks; owner: shared): Close gaps in the required Key Security Indicators and set up at least one automated method to verify and validate each one.
4. FedRAMP operational build-out (1–2 weeks; owner: shared): Stand up the security inbox, incident reporting, vulnerability detection and monthly reporting, significant change notifications, Ongoing Certification Reports and Quarterly Reviews, availability reporting, the trust center, the Secure Configuration Guide, and cryptographic module documentation.
5. Certification package authoring (1–2 weeks; owner: sequencer-assurance): Write the Certification Package Overview and Security Decision Record, including Key Security Indicator summaries and relevant policies, in human-readable and JSON form validated against FedRAMP's schemas.
6. Independent assessment (Scheduled by the assessor; not included in the estimate; owner: assessor): A FedRAMP Recognized assessor verifies and validates the cloud service offering. Sequencer Assurance provides independent assessment support: evidence preparation, technical walkthroughs, and help responding to findings.
7. Final validation and client submission (1–2 weeks; owner: client): Add the assessment summary to the package, re-verify it against the live cloud service offering, then the client submits the FedRAMP Certification Application within 3 months of the assessment.
8. FedRAMP review (Set by FedRAMP; not published in the rules dataset; owner: fedramp): FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review.

Note: Estimates cover Sequencer Assurance and client work only. Time for the independent assessment, which the assessor schedules, and for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by the assessor, FedRAMP, or GSA.

Deadlines set by the rules:

- Assessment freshness: The independent assessment must have been completed by a FedRAMP Recognized assessor within the previous 3 months at application. (FRC-APP-FIA)
- Package freshness: The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days. (FRC-APP-FCP)
- Marketplace assessment deadline: An assessment for Class B, C, or D must be scheduled within 2 years of the initial Marketplace listing, or FedRAMP removes the listing. (MKT-IIP-DLA)

## Cost

$80,000 when the client provides GRC tooling, or $120,000 all-in with Sequencer Assurance providing all GRC technology and tooling. Pricing model: tiered.

Range: $80,000–$120,000.

- Client tooling: $80,000. The client provides the GRC technology and tooling, including a FedRAMP-compatible trust center.
- All-in: $120,000. Sequencer Assurance provides all GRC technology and tooling, including the trust center.
- 50% at Kickoff
- 50% at Independent assessment performed
- Add-on, quoted separately: GRC tools from the client's maturity roadmap. Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee. Requires client approval before purchase.

## Deliverables

- Class B gap report [PDF, JSON]: Status of every Class B rule and Key Security Indicator against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record.
- Public cloud service offering information [HTML, JSON]: Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report and review dates.
- Key Security Indicator evidence [JSON, Markdown]: For each required Key Security Indicator: the measures in place, how they are verified and validated, at least one automated method, and historical metrics.
- FedRAMP operating runbooks [Markdown, PDF]: Procedures for the security inbox, incident reports, vulnerability detection, evaluation and monthly reporting, and significant change notifications.
- Ongoing Certification Report and Quarterly Review kit [PDF, JSON]: Quarterly report template and example, feedback mechanism, and Quarterly Review agenda and registration setup.
- Secure Configuration Guide [HTML, PDF]: Recommended secure settings for the cloud service offering, with instructions in the package for obtaining and using it.
- Certification package [HTML, JSON]: Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class B rule and Key Security Indicator. Each entry carries an implementation status, the independent assessor's assessment summary, and, where partially or not implemented, the reason and a plan with timeframes. The Security Decision Record also carries historical Key Security Indicator metrics. Includes Key Security Indicator summaries, relevant policies, cryptographic module documentation, and every referenced artifact and piece of evidence, all reachable from the trust center without an NDA or terms of service.
- Sample incident, change, and vulnerability reports [HTML, JSON]: Filled samples of the Initial, Ongoing, and Final Incident Reports, a Significant Change Notification, and vulnerability reporting with vulnerability details and accepted vulnerability information, plus historical vulnerability detection and response activity, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident, change, or report has occurred.
- Assessment support [JSON, PDF]: Evidence of implementation and effectiveness organized for the assessor, technical walkthroughs, and help responding to findings.
- Submission kit [PDF]: Final validation record, the assessor's overall summary added to the package, and a pre-filled guide for the client's FedRAMP Certification Application Form.

## Included

- Gap assessment against all 92 required Class B rules and 41 required Key Security Indicators, plus the optional rules the client already meets
- Authoring of the certification package, public JSON, and Secure Configuration Guide in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator
- Historical Key Security Indicator metrics for the Security Decision Record
- Sample incident, significant change, vulnerability, and Ongoing Certification Reports for the package
- A trust center access check so FedRAMP can open every package file without an NDA or terms of service
- A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included
- Design of automated verification and validation for the Security Decision Record's rule entries, which FedRAMP recommends for Class B and C; the client implements it
- Process design for inbox, incident, vulnerability, significant change, and quarterly reporting rules
- Evidence preparation and support during the independent assessment
- Support during FedRAMP review

## Not included

- The independent assessment itself, which a separate FedRAMP Recognized assessor performs
- Submitting the application on the client's behalf, which FedRAMP prohibits
- Engineering changes to the client's systems

## Client responsibilities

- Name a technical owner and an executive sponsor
- Engage and pay a FedRAMP Recognized assessor
- Supply evidence of implementation and effectiveness to the assessor
- Submit the FedRAMP Certification Application Form
- After handover, keep the package current monthly, report vulnerability activity monthly, and produce the quarterly Ongoing Certification Report and Quarterly Review (CPO-CSX-CPM, VER-TFR-MHR, CCM-OCR-AVL, CCM-QTR-MTG). [Drop Sequencer Assurance a note about custom retainers](https://sequencerassurance.com/contact/)

## Rules covered

| Rule | Force | Phase |
| --- | --- | --- |
| FRC-CSO-FCP | MUST | readiness |
| FRC-CSO-POP | MUST NOT | readiness |
| MAS-CSO-FLO | MUST | readiness |
| MAS-CSO-IIR | MUST | readiness |
| MAS-CSO-MDI | MUST | readiness |
| MAS-CSO-TPR | MUST | readiness |
| CCM-OCR-NRD | MUST | marketplace |
| CDS-CSO-PUB | MUST | marketplace |
| FRC-APP-MLF | MUST | marketplace |
| MKT-CSO-MLR | MUST | marketplace |
| MKT-CSO-PML | MUST | marketplace |
| KSI-CED-RAT | MUST | ksi |
| KSI-CMT-LMC | MUST | ksi |
| KSI-CMT-RMV | MUST | ksi |
| KSI-CMT-RVP | MUST | ksi |
| KSI-CMT-VTD | MUST | ksi |
| KSI-CNA-DFP | MUST | ksi |
| KSI-CNA-IBP | MUST | ksi |
| KSI-CNA-MAT | MUST | ksi |
| KSI-CNA-OFA | MUST | ksi |
| KSI-CNA-RNT | MUST | ksi |
| KSI-CNA-RVP | MUST | ksi |
| KSI-CNA-ULN | MUST | ksi |
| KSI-IAM-AAM | MUST | ksi |
| KSI-IAM-APM | MUST | ksi |
| KSI-IAM-ELP | MUST | ksi |
| KSI-IAM-JIT | MUST | ksi |
| KSI-IAM-SNU | MUST | ksi |
| KSI-IAM-SUS | MUST | ksi |
| KSI-INR-AAR | MUST | ksi |
| KSI-INR-RIR | MUST | ksi |
| KSI-INR-RPI | MUST | ksi |
| KSI-MLA-EVC | MUST | ksi |
| KSI-MLA-LET | MUST | ksi |
| KSI-MLA-OSM | MUST | ksi |
| KSI-MLA-RVL | MUST | ksi |
| KSI-PIY-GIV | MUST | ksi |
| KSI-PIY-RES | MUST | ksi |
| KSI-PIY-RIS | MUST | ksi |
| KSI-PIY-RSD | MUST | ksi |
| KSI-PIY-RVD | MUST | ksi |
| KSI-RPL-ABO | MUST | ksi |
| KSI-RPL-ARP | MUST | ksi |
| KSI-RPL-RRO | MUST | ksi |
| KSI-RPL-TRC | MUST | ksi |
| KSI-SCR-MIT | MUST | ksi |
| KSI-SCR-MON | MUST | ksi |
| KSI-SVC-ACM | MUST | ksi |
| KSI-SVC-ASM | MUST | ksi |
| KSI-SVC-EIS | MUST | ksi |
| KSI-SVC-SIN | MUST | ksi |
| KSI-SVC-VRI | MUST | ksi |
| AFC-CSO-CRA | MUST | operations |
| AFC-CSO-EMR | MUST | operations |
| AFC-CSO-INB | MUST | operations |
| AFC-CSO-NOC | MUST | operations |
| AFC-CSO-RCV | MUST | operations |
| AFC-CSO-TFG | MUST | operations |
| CCM-OCR-AFS | MUST | operations |
| CCM-OCR-AVL | MUST | operations |
| CCM-OCR-FBM | MUST | operations |
| CCM-OCR-LSI | MUST NOT | operations |
| CCM-QTR-NID | MUST NOT | operations |
| CCM-QTR-NRD | MUST | operations |
| CCM-QTR-REG | MUST | operations |
| CDS-CSO-AVR | MUST | operations |
| CDS-CSO-CBF | MUST | operations |
| CDS-CSO-FID | MUST | operations |
| CDS-CSO-FRC | MUST | operations |
| CDS-CSO-HAD | MUST | operations |
| CDS-CSO-IRP | MUST | operations |
| CDS-CSO-RIS | MUST | operations |
| CDS-CSO-SVC | MUST | operations |
| CDS-CSO-UTC | MUST | operations |
| CDS-TRC-AAI | MUST | operations |
| CDS-TRC-ACL | MUST | operations |
| CDS-TRC-PAC | MUST | operations |
| CDS-TRC-USH | MUST | operations |
| CDS-UTC-AAD | MUST | operations |
| CMU-CSO-CMD | MUST | operations |
| IEC-CSO-DPR | MUST | operations |
| IEC-CSO-EFR | MUST | operations |
| IEC-CSO-FIR | MUST | operations |
| IEC-CSO-IIR | MUST | operations |
| IEC-CSO-OIR | MUST | operations |
| SCG-CSO-AUP | MUST | operations |
| SCG-CSO-RSC | MUST | operations |
| SCN-ADP-NTF | MUST | operations |
| SCN-CSO-EVA | MUST | operations |
| SCN-CSO-HIS | MUST | operations |
| SCN-CSO-HRM | MUST | operations |
| SCN-CSO-INF | MUST | operations |
| SCN-CSO-MAR | MUST | operations |
| SCN-TRF-NAF | MUST | operations |
| SCN-TRF-NAV | MUST | operations |
| SCN-TRF-NFP | MUST | operations |
| SCN-TRF-NIP | MUST | operations |
| SCN-TRF-UPD | MUST | operations |
| VDR-CSO-DET | MUST | operations |
| VDR-CSO-FAV | MUST | operations |
| VDR-CSO-RES | MUST | operations |
| VDR-TFR-MVX | MUST | operations |
| VDR-TFR-NMV | MUST | operations |
| VER-EVA-AIA | MUST | operations |
| VER-EVA-EIR | MUST | operations |
| VER-EVA-ELX | MUST | operations |
| VER-EVA-EPA | MUST | operations |
| VER-RPT-AVI | MUST | operations |
| VER-RPT-NID | MUST NOT | operations |
| VER-RPT-PER | MUST | operations |
| VER-RPT-VDT | MUST | operations |
| VER-TFR-MAV | MUST | operations |
| VER-TFR-MHR | MUST | operations |
| CPO-CSO-MTD | MUST | package |
| CPO-CSO-OSA | MUST | package |
| CPO-CSO-OVR | MUST | package |
| CPO-CSX-CPM | MUST | package |
| FRC-CSO-JSN | MUST | package |
| FRC-CSO-MRA | MUST | package |
| FRC-CSO-PKG | MUST | package |
| SDR-CSO-FRR | MUST | package |
| SDR-CSO-MTD | MUST | package |
| SDR-CSX-KSI | MUST | package |
| IVV-CSO-DUS | MUST | assessment |
| IVV-CSO-FIA | MUST | assessment |
| IVV-CSO-ICP | MUST | assessment |
| IVV-CSO-SEE | MUST | assessment |
| IVV-CSO-SEI | MUST | assessment |
| IVV-CSX-AIA | MUST | assessment |
| FRC-APP-AFC | MUST | submission |
| FRC-APP-FCP | MUST | submission |
| FRC-APP-FIA | MUST | submission |
| FRC-APP-NTP | MUST NOT | submission |

## FAQ

**Should the client pursue Class B on 20x or Rev5?**

20x is FedRAMP's modern approach based primarily on measured outcomes, using Key Security Indicators with automated validation. Rev5 is the legacy approach based primarily on documented plans, using NIST SP 800-53 controls, and is the only type with an agency-sponsored path (FRD-CTY, FRD-CPH). A cloud service offering cannot seek both Program Certification types at once (FRC-CSO-POP).

**Does Class B require Class A or another framework first?**

No. Class B stands on its own independent assessment. A Class A Certification can cover agency use for up to 12 months while Class B is underway (AGU-USE-CLA).

**Is an independent assessor required for Class B?**

Yes. The client needs an assessment by a FedRAMP Recognized assessor completed within 3 months before applying (FRC-APP-FIA), and every year after certification (IVV-CSO-FIA).

**What does the cloud service offering need to keep doing after certification?**

Keep the package current monthly (CPO-CSX-CPM), report vulnerability activity monthly (VER-TFR-MHR), verify machine-based resources every 7 days (VDR-TFR-MVX), publish a quarterly Ongoing Certification Report (CCM-OCR-AVL), and complete an annual independent assessment (IVV-CSO-FIA).

**Can Sequencer Assurance submit the FedRAMP application for the client?**

No. FedRAMP prohibits third parties, including assessors, from applying on the client's behalf (FRC-APP-NTP). Sequencer Assurance prepares everything; the client submits.

Services menu version 1.0.0, updated 2026-10-25; FedRAMP rules checked against FedRAMP Consolidated Rules for 2026, version 2026.10.13.01.