Services / FedRAMP 20x Class B Certification
FedRAMP 20x Class B Certification
Take a cloud service offering through its first full FedRAMP 20x assessment to Class B.
Sequencer Assurance prepares a cloud service offering for a FedRAMP 20x Class B Certification: scope and gap assessment, Marketplace listing, implementation evidence for every required Key Security Indicator, the FedRAMP operational processes Class B requires, and a schema-valid certification package. Sequencer Assurance then supports the client through the independent assessment by a FedRAMP Recognized assessor and prepares the package for the client to submit.
- Price: $80,000 when the client provides GRC tooling, or $120,000 all-in with Sequencer Assurance providing all GRC technology and tooling
- Timeline: 5–10 weeks (estimate)
- FedRAMP profile: 20x, Program path, Class B
- Service ID: SVC-FED-B20
Book a 20x Class B readiness call
How much does FedRAMP 20x Class B cost?
$80,000 when the client provides GRC tooling, or $120,000 all-in with Sequencer Assurance providing all GRC technology and tooling.
- Client tooling: $80,000. The client provides the GRC technology and tooling, including a FedRAMP-compatible trust center. (CDS-CSO-UTC)
- The full fixed-scope 20x Class B engagement
- All-in: $120,000. Sequencer Assurance provides all GRC technology and tooling, including the trust center. (CDS-CSO-UTC, CDS-TRC-PAC, CDS-TRC-ACL, CDS-TRC-AAI)
- The full fixed-scope 20x Class B engagement
- All GRC technology and tooling, provided by Sequencer Assurance
How is it billed?
- 50% at Kickoff
- 50% at Independent assessment performed
Optional add-ons
- GRC tools from the client's maturity roadmap (quoted separately). Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee. Requires client approval before purchase.
What costs are outside the fee?
- Independent assessment by a FedRAMP Recognized assessor (required initially and every year)
- Licensing for the client's own GRC tooling and trust center (client tooling tier)
How long does FedRAMP 20x Class B take?
About 5 to 10 weeks of Sequencer Assurance and client work, plus the independent assessment. Marketplace listing and the operational build-out run alongside Key Security Indicator implementation.
Total: 5–10 weeks (estimate).
Client time: 20–60 hours in total. Spread across the engagement.
Phases
- Scope and gap assessment (1–2 weeks; owner: Sequencer Assurance). Confirm the Class B certification profile, define the Minimum Assessment Scope with information flows and third-party resources, and measure the gap against every Class B rule and Key Security Indicator. Deliverables: Class B gap report.
- Marketplace listing (1 day; owner: Shared). Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing. Deliverables: Public cloud service offering information.
- Key Security Indicator implementation (2–4 weeks; owner: Shared). Close gaps in the required Key Security Indicators and set up at least one automated method to verify and validate each one. Deliverables: Key Security Indicator evidence.
- FedRAMP operational build-out (1–2 weeks; owner: Shared). Stand up the security inbox, incident reporting, vulnerability detection and monthly reporting, significant change notifications, Ongoing Certification Reports and Quarterly Reviews, availability reporting, the trust center, the Secure Configuration Guide, and cryptographic module documentation. Deliverables: FedRAMP operating runbooks, Ongoing Certification Report and Quarterly Review kit, Secure Configuration Guide.
- Certification package authoring (1–2 weeks; owner: Sequencer Assurance). Write the Certification Package Overview and Security Decision Record, including Key Security Indicator summaries and relevant policies, in human-readable and JSON form validated against FedRAMP's schemas. Deliverables: Certification package, Sample incident, change, and vulnerability reports.
- Independent assessment (Scheduled by the assessor; not included in the estimate; owner: Assessor). A FedRAMP Recognized assessor verifies and validates the cloud service offering. Sequencer Assurance provides independent assessment support: evidence preparation, technical walkthroughs, and help responding to findings. Deliverables: Assessment support.
- Final validation and client submission (1–2 weeks; owner: Client). Add the assessment summary to the package, re-verify it against the live cloud service offering, then the client submits the FedRAMP Certification Application within 3 months of the assessment. Deliverables: Submission kit.
- FedRAMP review (Set by FedRAMP; not published in the rules dataset; owner: FedRAMP). FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review.
Estimates cover Sequencer Assurance and client work only. Time for the independent assessment, which the assessor schedules, and for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by the assessor, FedRAMP, or GSA.
What deadlines do the FedRAMP rules set?
- Assessment freshness (up to 3 months): The independent assessment must have been completed by a FedRAMP Recognized assessor within the previous 3 months at application. (FRC-APP-FIA)
- Package freshness (up to 7 days): The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days. (FRC-APP-FCP)
- Marketplace assessment deadline (up to 2 years): An assessment for Class B, C, or D must be scheduled within 2 years of the initial Marketplace listing, or FedRAMP removes the listing. (MKT-IIP-DLA)
Who is FedRAMP 20x Class B for?
- Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP 20x Class B certification
- Cloud service offerings with a Class A Certification that agencies expect to move to Class B within 12 months
- Cloud service offerings sold, or about to be sold, to US federal agencies directly or as a component of another cloud service offering
Who is it not for?
- Cloud service offerings whose only government use is meeting other compliance programs such as CMMC
- Cloud service offerings that need a Rev5 Program Certification or an agency-sponsored path
- Cloud service offerings that need a Class C or Class D Certification
Who is eligible for FedRAMP 20x Class B?
- Required: A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly. (MKT-IIP-AGU, MKT-FRP-SOF)
- Required: Not concurrently seeking a FedRAMP Rev5 Program Certification for the same cloud service offering. (FRC-CSO-POP)
- Required: Budget for an independent assessment by a FedRAMP Recognized assessor, initially and every year after certification. (FRC-APP-FIA, IVV-CSO-FIA)
- Preferred: An existing Class A Certification, SOC 2 Type II, or GovRAMP assessment shortens the work but is not required.
What does the client get from FedRAMP 20x Class B?
- A FedRAMP Marketplace listing with public human-readable and JSON information about the cloud service offering
- Implementation evidence for all 41 Key Security Indicators required for Class B, with at least one automated verification method each
- Running FedRAMP processes: security inbox, incident reporting, monthly vulnerability reporting, significant change notifications, quarterly Ongoing Certification Reports, and Quarterly Reviews
- A complete, schema-valid certification package that includes the independent assessment results, ready for the client to submit
- A Security Decision Record that addresses every MUST and SHOULD Class B rule and Key Security Indicator with an accurate implementation status, the independent assessor's summary for each, and timeframed plans for anything not yet fully implemented, plus historical Key Security Indicator metrics
- Package files FedRAMP can open from the trust center without an NDA or terms of service, so the package clears FedRAMP's pre-queue verification and enters the Review Queue sooner
What are the deliverables?
- Class B gap report (PDF, JSON): Status of every Class B rule and Key Security Indicator against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record. (FRC-CSO-FCP, MAS-CSO-IIR, MAS-CSO-FLO, MAS-CSO-TPR)
- Public cloud service offering information (HTML, JSON): Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report and review dates. (CDS-CSO-PUB, CDS-CSO-SVC, CCM-OCR-NRD, CCM-QTR-NRD)
- Key Security Indicator evidence (JSON, Markdown): For each required Key Security Indicator: the measures in place, how they are verified and validated, at least one automated method, and historical metrics. (SDR-CSX-KSI, SDR-CSX-KMT, FRC-CSX-VVK, IVV-CSX-AIA)
- FedRAMP operating runbooks (Markdown, PDF): Procedures for the security inbox, incident reports, vulnerability detection, evaluation and monthly reporting, and significant change notifications. (AFC-CSO-INB, IEC-CSO-IIR, IEC-CSO-OIR, IEC-CSO-FIR, VDR-CSO-RES, VER-TFR-MHR, SCN-CSO-EVA)
- Ongoing Certification Report and Quarterly Review kit (PDF, JSON): Quarterly report template and example, feedback mechanism, and Quarterly Review agenda and registration setup. (CCM-OCR-AVL, CCM-OCR-FBM, CCM-QTR-REG)
- Secure Configuration Guide (HTML, PDF): Recommended secure settings for the cloud service offering, with instructions in the package for obtaining and using it. (SCG-CSO-RSC, SCG-CSO-AUP)
- Certification package (HTML, JSON): Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class B rule and Key Security Indicator. Each entry carries an implementation status, the independent assessor's assessment summary, and, where partially or not implemented, the reason and a plan with timeframes. The Security Decision Record also carries historical Key Security Indicator metrics. Includes Key Security Indicator summaries, relevant policies, cryptographic module documentation, and every referenced artifact and piece of evidence, all reachable from the trust center without an NDA or terms of service. (FRC-CSO-PKG, CPO-CSO-OVR, SDR-CSO-FRR, CDS-CSO-IRP, CMU-CSO-CMD, IVV-IAS-SUM, FRC-CSX-VVR)
- Sample incident, change, and vulnerability reports (HTML, JSON): Filled samples of the Initial, Ongoing, and Final Incident Reports, a Significant Change Notification, and vulnerability reporting with vulnerability details and accepted vulnerability information, plus historical vulnerability detection and response activity, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident, change, or report has occurred. (IEC-CSO-IIR, IEC-CSO-OIR, IEC-CSO-FIR, SCN-CSO-INF, VER-RPT-VDT, VER-RPT-AVI, VER-TFR-MRH)
- Assessment support (JSON, PDF): Evidence of implementation and effectiveness organized for the assessor, technical walkthroughs, and help responding to findings. (IVV-CSO-SEI, IVV-CSO-SEE, IVV-CSO-ICP)
- Submission kit (PDF): Final validation record, the assessor's overall summary added to the package, and a pre-filled guide for the client's FedRAMP Certification Application Form. (FRC-APP-FCP, FRC-APP-FIA, CPO-CSO-OSA, IVV-IAS-OSA, FRC-APP-AFC, FRC-APP-NTP)
What is included?
- Gap assessment against all 92 required Class B rules and 41 required Key Security Indicators, plus the optional rules the client already meets
- Authoring of the certification package, public JSON, and Secure Configuration Guide in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator
- Historical Key Security Indicator metrics for the Security Decision Record
- Sample incident, significant change, vulnerability, and Ongoing Certification Reports for the package
- A trust center access check so FedRAMP can open every package file without an NDA or terms of service
- A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included
- Design of automated verification and validation for the Security Decision Record's rule entries, which FedRAMP recommends for Class B and C; the client implements it
- Process design for inbox, incident, vulnerability, significant change, and quarterly reporting rules
- Evidence preparation and support during the independent assessment
- Support during FedRAMP review
What is not included?
- The independent assessment itself, which a separate FedRAMP Recognized assessor performs
- Submitting the application on the client's behalf, which FedRAMP prohibits
- Engineering changes to the client's systems
What does the client need to do?
- Name a technical owner and an executive sponsor
- Engage and pay a FedRAMP Recognized assessor
- Supply evidence of implementation and effectiveness to the assessor
- Submit the FedRAMP Certification Application Form
- After handover, keep the package current monthly, report vulnerability activity monthly, and produce the quarterly Ongoing Certification Report and Quarterly Review (CPO-CSX-CPM, VER-TFR-MHR, CCM-OCR-AVL, CCM-QTR-MTG). Drop Sequencer Assurance a note about custom retainers
Frequently asked questions
Should the client pursue Class B on 20x or Rev5?
20x is FedRAMP's modern approach based primarily on measured outcomes, using Key Security Indicators with automated validation. Rev5 is the legacy approach based primarily on documented plans, using NIST SP 800-53 controls, and is the only type with an agency-sponsored path (FRD-CTY, FRD-CPH). A cloud service offering cannot seek both Program Certification types at once (FRC-CSO-POP).
Does Class B require Class A or another framework first?
No. Class B stands on its own independent assessment. A Class A Certification can cover agency use for up to 12 months while Class B is underway (AGU-USE-CLA).
Is an independent assessor required for Class B?
Yes. The client needs an assessment by a FedRAMP Recognized assessor completed within 3 months before applying (FRC-APP-FIA), and every year after certification (IVV-CSO-FIA).
What does the cloud service offering need to keep doing after certification?
Keep the package current monthly (CPO-CSX-CPM), report vulnerability activity monthly (VER-TFR-MHR), verify machine-based resources every 7 days (VDR-TFR-MVX), publish a quarterly Ongoing Certification Report (CCM-OCR-AVL), and complete an annual independent assessment (IVV-CSO-FIA).
Can Sequencer Assurance submit the FedRAMP application for the client?
No. FedRAMP prohibits third parties, including assessors, from applying on the client's behalf (FRC-APP-NTP). Sequencer Assurance prepares everything; the client submits.
Which FedRAMP rules does FedRAMP 20x Class B cover?
Each rule, its force, and the phase where Sequencer Assurance handles it.
| Rule | Name | Force | Phase |
|---|---|---|---|
| FRC-CSO-FCP | FedRAMP Certification Profile | MUST | Scope and gap assessment |
| FRC-CSO-POP | Pick One Program Certification Type | MUST NOT | Scope and gap assessment |
| MAS-CSO-FLO | Information Flows and Security Categories | MUST | Scope and gap assessment |
| MAS-CSO-IIR | Identify Information Resources | MUST | Scope and gap assessment |
| MAS-CSO-MDI | Metadata Inclusion | MUST | Scope and gap assessment |
| MAS-CSO-TPR | Third-Party Information Resources | MUST | Scope and gap assessment |
| CCM-OCR-NRD | Next Report Date | MUST | Marketplace listing |
| CDS-CSO-PUB | Public Information | MUST | Marketplace listing |
| FRC-APP-MLF | Marketplace Listing First | MUST | Marketplace listing |
| MKT-CSO-MLR | Marketplace Listing Requirements | MUST | Marketplace listing |
| MKT-CSO-PML | Provider Marketplace Listing Requests | MUST | Marketplace listing |
| KSI-CED-RAT | Reviewing All Training | MUST | Key Security Indicator implementation |
| KSI-CMT-LMC | Logging Changes | MUST | Key Security Indicator implementation |
| KSI-CMT-RMV | Redeploying vs Modifying | MUST | Key Security Indicator implementation |
| KSI-CMT-RVP | Reviewing Change Procedures | MUST | Key Security Indicator implementation |
| KSI-CMT-VTD | Validating Throughout Deployment | MUST | Key Security Indicator implementation |
| KSI-CNA-DFP | Defining Functionality and Privileges | MUST | Key Security Indicator implementation |
| KSI-CNA-IBP | Implementing Best Practices | MUST | Key Security Indicator implementation |
| KSI-CNA-MAT | Minimizing Attack Surface | MUST | Key Security Indicator implementation |
| KSI-CNA-OFA | Optimizing for Availability | MUST | Key Security Indicator implementation |
| KSI-CNA-RNT | Restricting Network Traffic | MUST | Key Security Indicator implementation |
| KSI-CNA-RVP | Reviewing Protections | MUST | Key Security Indicator implementation |
| KSI-CNA-ULN | Using Logical Networking | MUST | Key Security Indicator implementation |
| KSI-IAM-AAM | Automating Account Management | MUST | Key Security Indicator implementation |
| KSI-IAM-APM | Adopting Passwordless Methods | MUST | Key Security Indicator implementation |
| KSI-IAM-ELP | Ensuring Least Privilege | MUST | Key Security Indicator implementation |
| KSI-IAM-JIT | Authorizing Just-in-Time | MUST | Key Security Indicator implementation |
| KSI-IAM-SNU | Securing Non-User Authentication | MUST | Key Security Indicator implementation |
| KSI-IAM-SUS | Responding to Suspicious Activity | MUST | Key Security Indicator implementation |
| KSI-INR-AAR | Generating After Action Reports | MUST | Key Security Indicator implementation |
| KSI-INR-RIR | Reviewing Incident Response Procedures | MUST | Key Security Indicator implementation |
| KSI-INR-RPI | Reviewing Past Incidents | MUST | Key Security Indicator implementation |
| KSI-MLA-EVC | Evaluating Configurations | MUST | Key Security Indicator implementation |
| KSI-MLA-LET | Logging Event Types | MUST | Key Security Indicator implementation |
| KSI-MLA-OSM | Operating SIEM Capability | MUST | Key Security Indicator implementation |
| KSI-MLA-RVL | Reviewing Logs | MUST | Key Security Indicator implementation |
| KSI-PIY-GIV | Generating Inventories | MUST | Key Security Indicator implementation |
| KSI-PIY-RES | Reviewing Executive Support | MUST | Key Security Indicator implementation |
| KSI-PIY-RIS | Reviewing Investments in Security | MUST | Key Security Indicator implementation |
| KSI-PIY-RSD | Reviewing Security in the SDLC | MUST | Key Security Indicator implementation |
| KSI-PIY-RVD | Reviewing Vulnerability Disclosures | MUST | Key Security Indicator implementation |
| KSI-RPL-ABO | Aligning Backups with Objectives | MUST | Key Security Indicator implementation |
| KSI-RPL-ARP | Aligning Recovery Plan | MUST | Key Security Indicator implementation |
| KSI-RPL-RRO | Reviewing Recovery Objectives | MUST | Key Security Indicator implementation |
| KSI-RPL-TRC | Testing Recovery Capabilities | MUST | Key Security Indicator implementation |
| KSI-SCR-MIT | Mitigating Supply Chain Risk | MUST | Key Security Indicator implementation |
| KSI-SCR-MON | Monitoring Supply Chain Risk | MUST | Key Security Indicator implementation |
| KSI-SVC-ACM | Automating Configuration Management | MUST | Key Security Indicator implementation |
| KSI-SVC-ASM | Automating Secret Management | MUST | Key Security Indicator implementation |
| KSI-SVC-EIS | Evaluating and Improving Security | MUST | Key Security Indicator implementation |
| KSI-SVC-SIN | Securing Information | MUST | Key Security Indicator implementation |
| KSI-SVC-VRI | Validating Resource Integrity | MUST | Key Security Indicator implementation |
| AFC-CSO-CRA | Complete Required Actions | MUST | FedRAMP operational build-out |
| AFC-CSO-EMR | Emergency Message Routing | MUST | FedRAMP operational build-out |
| AFC-CSO-INB | Maintain a FedRAMP Security Inbox | MUST | FedRAMP operational build-out |
| AFC-CSO-NOC | Notification of Changes | MUST | FedRAMP operational build-out |
| AFC-CSO-RCV | Receive Email Without Disruption | MUST | FedRAMP operational build-out |
| AFC-CSO-TFG | Trust @fedramp.gov and @gsa.gov | MUST | FedRAMP operational build-out |
| CCM-OCR-AFS | Anonymized Feedback Summary | MUST | FedRAMP operational build-out |
| CCM-OCR-AVL | Report Availability | MUST | FedRAMP operational build-out |
| CCM-OCR-FBM | Feedback Mechanism | MUST | FedRAMP operational build-out |
| CCM-OCR-LSI | Limit Sensitive Information | MUST NOT | FedRAMP operational build-out |
| CCM-QTR-NID | No Irresponsible Disclosure | MUST NOT | FedRAMP operational build-out |
| CCM-QTR-NRD | Next Review Date | MUST | FedRAMP operational build-out |
| CCM-QTR-REG | Meeting Registration Info | MUST | FedRAMP operational build-out |
| CDS-CSO-AVR | Availability Reporting | MUST | FedRAMP operational build-out |
| CDS-CSO-CBF | Consistency Between Formats | MUST | FedRAMP operational build-out |
| CDS-CSO-FID | Always Include FedRAMP ID | MUST | FedRAMP operational build-out |
| CDS-CSO-FRC | FedRAMP Certification Reports | MUST | FedRAMP operational build-out |
| CDS-CSO-HAD | Historical FedRAMP Certification Data | MUST | FedRAMP operational build-out |
| CDS-CSO-IRP | Include Relevant Policies | MUST | FedRAMP operational build-out |
| CDS-CSO-RIS | Responsible Information Sharing | MUST | FedRAMP operational build-out |
| CDS-CSO-SVC | Public Service List | MUST | FedRAMP operational build-out |
| CDS-CSO-UTC | Use Trust Centers | MUST | FedRAMP operational build-out |
| CDS-TRC-AAI | Agency Access Inventory | MUST | FedRAMP operational build-out |
| CDS-TRC-ACL | Access Logging | MUST | FedRAMP operational build-out |
| CDS-TRC-PAC | Programmatic Access | MUST | FedRAMP operational build-out |
| CDS-TRC-USH | Uninterrupted Sharing | MUST | FedRAMP operational build-out |
| CDS-UTC-AAD | Agency Access Denial | MUST | FedRAMP operational build-out |
| CMU-CSO-CMD | Cryptographic Module Documentation | MUST | FedRAMP operational build-out |
| IEC-CSO-DPR | Default PAIN Rating | MUST | FedRAMP operational build-out |
| IEC-CSO-EFR | Evaluate FedRAMP Reportability | MUST | FedRAMP operational build-out |
| IEC-CSO-FIR | Final Incident Report | MUST | FedRAMP operational build-out |
| IEC-CSO-IIR | Initial Incident Report | MUST | FedRAMP operational build-out |
| IEC-CSO-OIR | Ongoing Incident Reports | MUST | FedRAMP operational build-out |
| SCG-CSO-AUP | Use Instructions | MUST | FedRAMP operational build-out |
| SCG-CSO-RSC | Recommended Secure Configuration | MUST | FedRAMP operational build-out |
| SCN-ADP-NTF | Notification Requirements | MUST | FedRAMP operational build-out |
| SCN-CSO-EVA | Evaluate Changes | MUST | FedRAMP operational build-out |
| SCN-CSO-HIS | Historical Notifications | MUST | FedRAMP operational build-out |
| SCN-CSO-HRM | Human and Machine-Readable Notifications | MUST | FedRAMP operational build-out |
| SCN-CSO-INF | Required Information | MUST | FedRAMP operational build-out |
| SCN-CSO-MAR | Maintain Audit Records | MUST | FedRAMP operational build-out |
| SCN-TRF-NAF | Notification After Finishing | MUST | FedRAMP operational build-out |
| SCN-TRF-NAV | Notification After Verification | MUST | FedRAMP operational build-out |
| SCN-TRF-NFP | Notification of Final Plans | MUST | FedRAMP operational build-out |
| SCN-TRF-NIP | Notification of Initial Plans | MUST | FedRAMP operational build-out |
| SCN-TRF-UPD | Update Documentation | MUST | FedRAMP operational build-out |
| VDR-CSO-DET | Vulnerability Detection | MUST | FedRAMP operational build-out |
| VDR-CSO-FAV | Failures Are Vulnerabilities | MUST | FedRAMP operational build-out |
| VDR-CSO-RES | Vulnerability Response | MUST | FedRAMP operational build-out |
| VDR-TFR-MVX | Persistent Machine Verification and Validation for 20x | MUST | FedRAMP operational build-out |
| VDR-TFR-NMV | Non-Machine Verification and Validation | MUST | FedRAMP operational build-out |
| VER-EVA-AIA | Assume It's Automatable | MUST | FedRAMP operational build-out |
| VER-EVA-EIR | Evaluate Internet-Reachability | MUST | FedRAMP operational build-out |
| VER-EVA-ELX | Evaluate Exploitability | MUST | FedRAMP operational build-out |
| VER-EVA-EPA | Estimate Potential Agency Impact | MUST | FedRAMP operational build-out |
| VER-RPT-AVI | Accepted Vulnerability Info | MUST | FedRAMP operational build-out |
| VER-RPT-NID | Responsible Disclosure | MUST NOT | FedRAMP operational build-out |
| VER-RPT-PER | Persistent Reporting | MUST | FedRAMP operational build-out |
| VER-RPT-VDT | Vulnerability Details | MUST | FedRAMP operational build-out |
| VER-TFR-MAV | Mark Accepted Vulnerabilities | MUST | FedRAMP operational build-out |
| VER-TFR-MHR | Monthly Activity Report | MUST | FedRAMP operational build-out |
| CPO-CSO-MTD | Certification Package Overview Metadata | MUST | Certification package authoring |
| CPO-CSO-OSA | Overall Summary of Assessment in Certification Package | MUST | Certification package authoring |
| CPO-CSO-OVR | Overview of the Cloud Service Offering | MUST | Certification package authoring |
| CPO-CSX-CPM | Certification Package Maintenance for 20x | MUST | Certification package authoring |
| FRC-CSO-JSN | FedRAMP JSON Schemas | MUST | Certification package authoring |
| FRC-CSO-MRA | Maintain Responsibility and Accountability | MUST | Certification package authoring |
| FRC-CSO-PKG | FedRAMP Certification Package | MUST | Certification package authoring |
| SDR-CSO-FRR | FedRAMP Rules | MUST | Certification package authoring |
| SDR-CSO-MTD | Security Decision Record Metadata | MUST | Certification package authoring |
| SDR-CSX-KSI | Key Security Indicators | MUST | Certification package authoring |
| IVV-CSO-DUS | Document Use of Representative Samples | MUST | Independent assessment |
| IVV-CSO-FIA | FedRAMP Independent Assessments | MUST | Independent assessment |
| IVV-CSO-ICP | Inclusion in Certification Package | MUST | Independent assessment |
| IVV-CSO-SEE | Supply Evidence of Effectiveness | MUST | Independent assessment |
| IVV-CSO-SEI | Supply Evidence of Implementation | MUST | Independent assessment |
| IVV-CSX-AIA | Annual Independent Assessments for 20x | MUST | Independent assessment |
| FRC-APP-AFC | Applying for FedRAMP Certification | MUST | Final validation and client submission |
| FRC-APP-FCP | Fresh FedRAMP Certification Package | MUST | Final validation and client submission |
| FRC-APP-FIA | Fresh Independent Assessment | MUST | Final validation and client submission |
| FRC-APP-NTP | No Third-Party Applicants | MUST NOT | Final validation and client submission |
Related services
- FedRAMP 20x Class A Certification: Class A can cover agency use for up to 12 months while Class B is underway.
- FedRAMP Rev5 Class B Certification: Class B on the Rev5 path, including agency sponsorship.
- FedRAMP 20x Class C Certification: 20x Class C, for cloud service offerings that need more assurance.