# FedRAMP Rev5 Class B Certification

- ID: SVC-FED-B5R
- FedRAMP profile: Rev5, Program or Agency path, Class B
- Status: active
- Page: https://sequencerassurance.com/services/fedramp-class-b-rev5/

Sequencer Assurance prepares a cloud service offering for a FedRAMP Rev5 Class B Certification on either path: directly through FedRAMP, or with an agency sponsor. The work covers scope and gap assessment, Marketplace listing, implementation and documentation of the 155 NIST SP 800-53 Rev. 5 controls Class B requires, the FedRAMP operational processes, and a schema-valid certification package. Sequencer Assurance then supports the client through the independent assessment by a FedRAMP Recognized assessor and prepares the package for the client to submit.

## Who it is for

- Cloud service offerings already instructed by an existing government or government-adjacent customer or prospect to pursue a FedRAMP Rev5 Class B certification
- Cloud service offerings with an agency sponsor ready to issue an Authorization to Operate
- Cloud service offerings with FedRAMP Ready status that must convert to a FedRAMP Certification
- Cloud service offerings with a Class A Certification that agencies expect to move to Class B within 12 months

## Who it is not for

- Cloud service offerings whose only government use is meeting other compliance programs such as CMMC
- Cloud service offerings pursuing a FedRAMP 20x Program Certification
- Cloud service offerings that need a Class C or Class D Certification

## Eligibility

- Required: A federal use case: direct use by agencies, or inclusion in another cloud service offering that agencies use directly. (MKT-IIP-AGU, MKT-FRP-SOF)
- Required: Not concurrently seeking a FedRAMP 20x Program Certification for the same cloud service offering. (FRC-CSO-POP)
- Required: Budget for an independent assessment by a FedRAMP Recognized assessor, initially and every year after certification. (FRC-APP-FIA, IVV-CSO-FIA)
- Required: Agency path only: the sponsoring agency completes its Authorization to Operate and sends the signed ATO letter to FedRAMP. (FRC-APS-ATO)
- Preferred: An existing FedRAMP Ready status, Class A Certification, SOC 2 Type II, or GovRAMP assessment shortens the work but is not required.

## Timeline

About 4 to 8 weeks of Sequencer Assurance and client work, plus the independent assessment. Marketplace listing and the operational build-out run alongside control implementation and documentation.

Total: 4–8 weeks (estimate).

Client time: 20–60 hours total, spread across the engagement.

1. Scope and gap assessment (1–2 weeks; owner: sequencer-assurance): Confirm the Rev5 Class B certification profile and path, define the Minimum Assessment Scope with information flows and third-party resources, and measure the gap against every Class B rule and control.
2. Marketplace listing (1 day; owner: shared): Publish the required public information about the cloud service offering as web pages and JSON, document progress milestones, and request the FedRAMP Marketplace listing.
3. Control implementation and documentation (1–2 weeks; owner: shared): Close gaps in the 155 required controls, assign every organization-defined parameter, and document each control following FedRAMP Rev5 Controls Guidance.
4. FedRAMP operational build-out (1–2 weeks; owner: shared): Stand up the security inbox, incident reporting, vulnerability detection and monthly reporting, significant change notifications, Ongoing Certification Reports and Quarterly Reviews, availability reporting, the trust center, the Secure Configuration Guide, and cryptographic module documentation.
5. Certification package authoring (1–2 weeks; owner: sequencer-assurance): Write the Certification Package Overview and Security Decision Record, including control summaries, parameter assignments, and relevant policies, in human-readable and JSON form validated against FedRAMP's schemas.
6. Independent assessment (Scheduled by the assessor; not included in the estimate; owner: assessor): A FedRAMP Recognized assessor verifies and validates the cloud service offering. Sequencer Assurance provides independent assessment support: evidence preparation, technical walkthroughs, and help responding to findings.
7. Final validation and client submission (1–2 weeks; owner: client): Add the assessment summary to the package, re-verify it against the live cloud service offering, then the client submits the FedRAMP Certification Application within 3 months of the assessment. On the agency path, the sponsoring agency also sends its signed ATO letter to FedRAMP.
8. FedRAMP review (Set by FedRAMP; not published in the rules dataset; owner: fedramp): FedRAMP reviews the package and issues a certification report. Sequencer Assurance answers questions and makes corrections during review.

Note: Estimates cover Sequencer Assurance and client work only. Time for the independent assessment, which the assessor schedules, and for FedRAMP-owned activities, such as Marketplace listing approval and certification review, is not included, and Sequencer Assurance cannot control delays caused by the assessor, FedRAMP, or GSA.

Deadlines set by the rules:

- Assessment freshness: The independent assessment must have been completed by a FedRAMP Recognized assessor within the previous 3 months at application. (FRC-APP-FIA)
- Package freshness: The submitted package must show the cloud service offering's status as verified and validated within the previous 7 days. (FRC-APP-FCP)
- Marketplace assessment deadline: An assessment for Class B, C, or D must be scheduled within 2 years of the initial Marketplace listing, or FedRAMP removes the listing. (MKT-IIP-DLA)
- FedRAMP Ready conversion: Cloud service offerings with FedRAMP Ready status must convert to a FedRAMP Certification by November 17, 2026 or the expiration of their annual assessment, whichever is later. (FRC-CSF-RDY)

## Cost

$120,000 all-in with Sequencer Assurance providing all GRC technology and tooling, or a custom quote when the client provides GRC tooling. Pricing model: tiered.

- Client tooling: custom quote. The client provides the GRC technology and tooling, including a FedRAMP-compatible trust center. Priced per client because tooling varies widely.
- All-in: $120,000. Sequencer Assurance provides all GRC technology and tooling, including the trust center.
- 50% at Kickoff
- 50% at Independent assessment performed
- Add-on, quoted separately: GRC tools from the client's maturity roadmap. Sequencer Assurance is a vendor-neutral value-added reseller (VAR) of GRC tools. Products recommended on the client's maturity roadmap may be added and are priced separately from the fixed fee. Requires client approval before purchase.

## Deliverables

- Class B gap report [PDF, JSON]: Status of every Class B rule and control against the current cloud service offering, with owners and effort, and the optional rules the client already meets and can take credit for in the Security Decision Record.
- Public cloud service offering information [HTML, JSON]: Human-readable page and JSON feed with FedRAMP ID, service list, contacts, trust center link, and next report and review dates.
- Control implementation documentation [JSON, Markdown]: Implementation summaries for the 155 required controls and the organization-defined parameter assignments.
- FedRAMP operating runbooks [Markdown, PDF]: Procedures for the security inbox, incident reports, vulnerability detection, evaluation and monthly reporting, and significant change notifications.
- Ongoing Certification Report and Quarterly Review kit [PDF, JSON]: Quarterly report template and example, feedback mechanism, and Quarterly Review agenda and registration setup.
- Secure Configuration Guide [HTML, PDF]: Recommended secure settings for the cloud service offering, with instructions in the package for obtaining and using it.
- Certification package [HTML, JSON]: Certification Package Overview and Security Decision Record covering every MUST and SHOULD Class B rule and control. Each entry carries an implementation status, the independent assessor's assessment summary, and, where partially or not implemented, the reason and a plan with timeframes. Includes control summaries, relevant policies, cryptographic module documentation, and every referenced artifact and piece of evidence, all reachable from the trust center without an NDA or terms of service.
- Sample incident, change, and vulnerability reports [HTML, JSON]: Filled samples of the Initial, Ongoing, and Final Incident Reports, a Significant Change Notification, and vulnerability reporting with vulnerability details and accepted vulnerability information, plus historical vulnerability detection and response activity, in human-readable and machine-readable form. FedRAMP expects these samples in the package even before any incident, change, or report has occurred.
- Assessment support [JSON, PDF]: Evidence of implementation and effectiveness organized for the assessor, technical walkthroughs, and help responding to findings.
- Submission kit [PDF]: Final validation record, the assessor's overall summary added to the package, and a pre-filled guide for the client's FedRAMP Certification Application Form.

## Included

- Gap assessment against all 99 required Class B rules and 155 required controls, plus the optional rules the client already meets
- Control documentation, the certification package, public JSON, and the Secure Configuration Guide in human-readable and machine-readable form, checked with FedRAMP's JSON Schema Validator
- Sample incident, significant change, vulnerability, and Ongoing Certification Reports for the package
- A trust center access check so FedRAMP can open every package file without an NDA or terms of service
- A lean package: only material that supports FedRAMP's risk-based decision, since FedRAMP reviews everything included
- Process design for inbox, incident, vulnerability, significant change, and quarterly reporting rules
- Evidence preparation and support during the independent assessment
- Support during FedRAMP review

## Not included

- The independent assessment itself, which a separate FedRAMP Recognized assessor performs
- The sponsoring agency's Authorization to Operate process on the agency path
- Submitting the application on the client's behalf, which FedRAMP prohibits
- Engineering changes to the client's systems

## Client responsibilities

- Name a technical owner and an executive sponsor
- Agency path: coordinate the Authorization to Operate with the sponsoring agency
- Engage and pay a FedRAMP Recognized assessor
- Supply evidence of implementation and effectiveness to the assessor
- Submit the FedRAMP Certification Application Form
- After handover, keep the package current at least yearly, report vulnerability activity monthly, produce the quarterly Ongoing Certification Report and Quarterly Review, and include previously failed controls in the next assessment (CPO-CSF-CPM, VER-TFR-MHR, CCM-OCR-AVL, CCM-QTR-MTG, IVV-CSF-ACF). [Drop Sequencer Assurance a note about custom retainers](https://sequencerassurance.com/contact/)

## Rules covered

| Rule | Force | Phase |
| --- | --- | --- |
| FRC-CSF-RDY | MUST | readiness |
| FRC-CSO-FCP | MUST | readiness |
| FRC-CSO-POP | MUST NOT | readiness |
| MAS-CSO-FLO | MUST | readiness |
| MAS-CSO-IIR | MUST | readiness |
| MAS-CSO-MDI | MUST | readiness |
| MAS-CSO-TPR | MUST | readiness |
| CCM-OCR-NRD | MUST | marketplace |
| CDS-CSO-PUB | MUST | marketplace |
| FRC-APP-MLF | MUST | marketplace |
| MKT-CSO-MLR | MUST | marketplace |
| MKT-CSO-PML | MUST | marketplace |
| FRC-CSF-ACP | MUST | controls |
| FRC-CSF-BSL | MUST | controls |
| FRC-CSF-FFG | MUST | controls |
| AFC-CSO-CRA | MUST | operations |
| AFC-CSO-EMR | MUST | operations |
| AFC-CSO-INB | MUST | operations |
| AFC-CSO-NOC | MUST | operations |
| AFC-CSO-RCV | MUST | operations |
| AFC-CSO-TFG | MUST | operations |
| CCM-OCR-AFS | MUST | operations |
| CCM-OCR-AVL | MUST | operations |
| CCM-OCR-FBM | MUST | operations |
| CCM-OCR-LSI | MUST NOT | operations |
| CCM-QTR-NID | MUST NOT | operations |
| CCM-QTR-NRD | MUST | operations |
| CCM-QTR-REG | MUST | operations |
| CDS-CSF-TCM | MUST | operations |
| CDS-CSO-AVR | MUST | operations |
| CDS-CSO-CBF | MUST | operations |
| CDS-CSO-FID | MUST | operations |
| CDS-CSO-FRC | MUST | operations |
| CDS-CSO-HAD | MUST | operations |
| CDS-CSO-IRP | MUST | operations |
| CDS-CSO-RIS | MUST | operations |
| CDS-CSO-SVC | MUST | operations |
| CDS-CSO-UTC | MUST | operations |
| CDS-TRC-AAI | MUST | operations |
| CDS-TRC-ACL | MUST | operations |
| CDS-TRC-PAC | MUST | operations |
| CDS-TRC-USH | MUST | operations |
| CDS-UTC-AAD | MUST | operations |
| CMU-CSO-CMD | MUST | operations |
| IEC-CSO-DPR | MUST | operations |
| IEC-CSO-EFR | MUST | operations |
| IEC-CSO-FIR | MUST | operations |
| IEC-CSO-IIR | MUST | operations |
| IEC-CSO-OIR | MUST | operations |
| SCG-CSO-AUP | MUST | operations |
| SCG-CSO-RSC | MUST | operations |
| SCN-ADP-NTF | MUST | operations |
| SCN-CSO-EVA | MUST | operations |
| SCN-CSO-HIS | MUST | operations |
| SCN-CSO-HRM | MUST | operations |
| SCN-CSO-INF | MUST | operations |
| SCN-CSO-MAR | MUST | operations |
| SCN-TRF-NAF | MUST | operations |
| SCN-TRF-NAV | MUST | operations |
| SCN-TRF-NFP | MUST | operations |
| SCN-TRF-NIP | MUST | operations |
| SCN-TRF-UPD | MUST | operations |
| VDR-CSO-DET | MUST | operations |
| VDR-CSO-FAV | MUST | operations |
| VDR-CSO-RES | MUST | operations |
| VDR-TFR-NMV | MUST | operations |
| VER-EVA-AIA | MUST | operations |
| VER-EVA-EIR | MUST | operations |
| VER-EVA-ELX | MUST | operations |
| VER-EVA-EPA | MUST | operations |
| VER-RPT-AVI | MUST | operations |
| VER-RPT-NID | MUST NOT | operations |
| VER-RPT-PER | MUST | operations |
| VER-RPT-VDT | MUST | operations |
| VER-TFR-MAV | MUST | operations |
| VER-TFR-MHR | MUST | operations |
| CPO-CSF-CPM | MUST | package |
| CPO-CSO-MTD | MUST | package |
| CPO-CSO-OSA | MUST | package |
| CPO-CSO-OVR | MUST | package |
| FRC-CSO-JSN | MUST | package |
| FRC-CSO-MRA | MUST | package |
| FRC-CSO-PKG | MUST | package |
| SDR-CSF-CTF | MUST | package |
| SDR-CSO-FRR | MUST | package |
| SDR-CSO-MTD | MUST | package |
| IVV-CSF-ACF | MUST | assessment |
| IVV-CSF-AIA | MUST | assessment |
| IVV-CSF-MCA | MUST | assessment |
| IVV-CSO-DUS | MUST | assessment |
| IVV-CSO-FIA | MUST | assessment |
| IVV-CSO-ICP | MUST | assessment |
| IVV-CSO-SEE | MUST | assessment |
| IVV-CSO-SEI | MUST | assessment |
| FRC-APP-AFC | MUST | submission |
| FRC-APP-FCP | MUST | submission |
| FRC-APP-FIA | MUST | submission |
| FRC-APP-NTP | MUST NOT | submission |
| FRC-APS-ATO | MUST | submission |

## FAQ

**Should the client pursue Class B on 20x or Rev5?**

20x is FedRAMP's modern approach based primarily on measured outcomes, using Key Security Indicators with automated validation. Rev5 is the legacy approach based primarily on documented plans, using NIST SP 800-53 controls, and is the only type with an agency-sponsored path (FRD-CTY, FRD-CPH). A cloud service offering cannot seek both Program Certification types at once (FRC-CSO-POP).

**What is the difference between the Program and Agency paths?**

On the Program path, FedRAMP certifies the cloud service offering directly. On the Agency path, a sponsoring agency completes its own Authorization to Operate and sends the signed ATO letter to FedRAMP, which still reviews and approves the certification (FRD-CPH, FRC-APS-ATO).

**When do the Rev5 rules become required?**

New Rev5 certifications must follow these rules from January 1, 2027. They can be adopted now.

**Is an independent assessor required for Class B?**

Yes. The client needs an assessment by a FedRAMP Recognized assessor completed within 3 months before applying (FRC-APP-FIA). After certification, 35 named controls are assessed every year and all controls at least every 3 years (IVV-CSF-AIA, IVV-CSF-MCA).

**Can Sequencer Assurance submit the FedRAMP application for the client?**

No. FedRAMP prohibits third parties, including assessors, from applying on the client's behalf (FRC-APP-NTP). Sequencer Assurance prepares everything; the client submits.

Services menu version 1.0.0, updated 2026-10-25; FedRAMP rules checked against FedRAMP Consolidated Rules for 2026, version 2026.10.13.01.