FedRAMP 20x ushered in a new era for federal compliance. Previously, FedRAMP authorization came with a hefty price tag, extended timeline, and required federal agency sponsorship. Under the new rules, more organizations can become certified quicker and at a lower cost, opening the door to new federal revenue. 

For those with a SOC 2, the path to FedRAMP has never been more accessible. FedRAMP has now allowed a SOC 2 Type II report to get you started with Class A, which means organizations can put their name on the marketplace and be exposed to the largest buyer in the world, the federal government. 

What’s changed? 

The 2026 Consolidated Rules (CR26) introduced a new set of classes for FedRAMP certification: Class A, B, C and D: 

Class	Presumption of adequacy
Class A	Adequate for use in pilots, during configuration and testing, or for extremely low or negligible risk use cases such as processing public information or getting started with very few users.
Class B	Adequate for use in most Low impact agency information systems and some Moderate or High impact agency information systems with appropriate compensating controls.
Class C	Adequate for use in most Low or Moderate impact agency information systems and some High impact agency information systems with appropriate compensating controls.
Class D	Adequate for use in most agency information systems regardless of the impact level, especially when deployed with appropriate compensating controls.

Class A, the introductory level, is a transitional, entry point built specifically to leverage SOC 2 Type II reports. This class is designed to be the on-ramp to be listed on the FedRAMP Marketplace and moving up to Classes B, C, and D in the coming years. A valid SOC 2 Type II report is the fastest qualifying path to Class A. 

Why Class A? 

FedRAMP 20x Class A isn’t a check-the-box compliance activity, it’s a market visibility play and business driver. Class A allows your organization to be listed on the FedRAMP Marketplace, signaling to federal buyers that your organization is actively in the pipeline. Adopting Class A as pipelines open in August 2026 signals that your organization is an early mover and ready to get selling. 

Especially if your program is already SOC 2 Type II compliant, Class A unlocks a lucrative source of revenue for your organization with a relatively low lift. If your organization is ready, it takes just one week to use a SOC 2 Type II to get FedRAMP 20x Class A certified. Class A won’t get you the contract, but it gets you in the room where the contract gets decided. 

How does it work? 

To use your SOC 2 Type II report to qualify for Class A, a qualified assessor can identify where your existing SOC 2 work already covers what FedRAMP asks for and where the gaps are. Your assessor should be experienced in federal compliance, tech-enabled, and have clear processes to guide your organization in this certification process. 

SOC 2 as a base for Class A 

A SOC 2 Type II report qualifies your organization to begin your FedRAMP journey at Class A, provided the report was completed within the last 12 months.  

Class A includes three rulesets and seven KSIs. These include:  

Rulesets 

1. Certification Package Overview (1 rule)  

2. FedRAMP Certification (17 rules)  

3. Marketplace Listing (12 rules)  

KSIs 

1. Training effectiveness review: Regularly checking that security training is working, across general staff, high-risk roles, engineers, and anyone involved in incident response. 

2. Change logging: Changes to service are logged and monitored. 

3. Network traffic restriction: Systems are regularly reviewed to confirm they limit inbound and outbound traffic. 

4. Automated account management: Accounts, roles, and groups are managed across their full lifecycle using automation. 

5. Passwordless authentication: Secure passwordless methods are used where feasible, and strong passwords with phishing-resistant MFA are used otherwise. 

6. Incident response review: Documented incident response procedures are regularly reviewed for effectiveness.  

7. Securing Information: Information is encrypted or otherwise protected from unwanted access or modification. 

Your path to FedRAMP 20x Class A 

A high-quality assessor will walk you through the assessment process with clarity. 

Step 0 – Understand the 20x basics   

Step 1 – Choose your independent assessor 

Step 2 – Build your profile: your type, class, and path  

Step 3 – Compare your SOC 2 Type II work to Class A requirements 

Step 4 – Submit your package and FedRAMP review  

Step 5 – Receive your Class A certification 

See where you stand 

Working with a tech-enabled assessor will empower your organization to see where you stand for 20x Class A. Audit management platforms like A-SCEND that already house your SOC 2 evidence or can ingest your existing SOC 2 report make mapping requirements simple. This means that you aren’t starting over, you have a starting point. A-SCEND has an EvidenceIQ cross-service report that maps your SOC 2 evidence against the 20x request list and shows where you already have coverage and where the gaps are. With tools like EvidenceIQ, rather than starting a new program, you’re extending an existing one. 

Growing with you: the transition path 

Class A is a door, not a destination. Class A holders are intended to be transitory. There is no expiration date or hard conversion deadline. Working with a high-quality independent assessor will give your team a structure from the start and a clear path to higher classes that enable you to confidently sell to the federal government. Class A is designed specifically to help your organization enter the market. 

Progressing to Class B, C, or D requires additional KSIs across added rulesets with different goals. While Class A is designed for organizations to enter the market, higher classes are focused on proving evidence independently and covering what agencies run. Each class builds on the last, and nothing you build is thrown away as you progress through the classes. 

Why A-LIGN 

A-LIGN is a top three FedRAMP assessor with a 100% PMO acceptance since 2013. 

Our high-quality, tech-enabled approach is already built for 20x. A-SCEND, our FedRAMP 20x-certified platform, is the only one of its kind built by an independent assessor. A-SCEND outputs evidence in machine-readable format, meaning fewer evidence requests, faster assessments, and ongoing visibility into your evidence status. 

Don’t delay this opportunity, reach out today to get started on your journey to FedRAMP 20x.