From SOC 2 to FedRAMP 20x: A Smarter Path into the Federal Cloud Market
For years, many SaaS and cloud companies have looked at FedRAMP and reached a familiar conclusion: not yet.
The federal opportunity might be attractive, but pursuing FedRAMP has traditionally been associated with a substantial investment in controls, assessments, documentation and ongoing compliance. For commercially mature SaaS companies that have already invested heavily in SOC 2, ISO 27001 and enterprise security, it could feel like building another compliance program alongside the one they already had.
FedRAMP 20x changes that starting point.
For qualifying providers, Class A creates an entry route built around a different premise: use mature commercial security assurance where it already exists, then address the additional requirements FedRAMP needs.
That makes one question particularly important for SaaS companies with a current SOC 2 Type II report: How much of your FedRAMP 20x Class A journey have you effectively already started?
The answer will vary by organization.But for companies with mature security and compliance programs, the incrementalwork may look very different from building a federal security program from scratch.
Class A changes the FedRAMP entry point
Class A is the initial FedRAMP 20x certification tier for mature cloud providers entering the federal ecosystem.
Under the current Consolidated Rules for 2026, providers seeking Class A must have completed an approved alternative security framework within the previous 12 months. FedRAMP currently recognizes three alternatives: FedRAMP Rev5, including FedRAMP Ready, at any historicalImpact Level; SOC 2 Type II; and GovRAMP at any Impact Level.
That makes Class A particularly interesting for established SaaS companies.
A provider that already sells into enterprise markets may have years of security investment behind it: identity and access controls, vulnerability management, secure development, logging, monitoring, incident response, risk assessments, policies and independent audits.
Class A does not require those companies to pretend that work never happened.
However, Class A should be viewed as an entry point, not necessarily the final destination.
Under current FedRAMP guidance, agencies should not authorize a Class A-certified cloud service for more than 12 months unless the provider is actively seeking Class B, C or D certification. (FedRAMP)
That changes how companies should think about the business case. Class A can provide a more practical way intoFedRAMP, but organizations should approach it as the first stage of a broader federal assurance journey rather than a permanent substitute for higher certification classes.
The SOC 2 Type II advantage
SOC 2 Type II is explicitly recognized as one of the alternative security frameworks that can support Class A eligibility, provided the applicable process was completed within the previous 12 months.
For a SOC 2-mature organization, considerable security assurance work has already happened - Controls have been defined. They have operated over time. Evidence has been collected. Independent testing has taken place. Exceptions have been identified. Security processes have been documented and reviewed.
And FedRAMP does not simply ask you to state that you have a SOC 2 report. Under the current rules, SOC 2-based applicants must make available the complete SOC 2 Type II report, a bridge or gap letter where applicable, verified audit-engagement documentation, the estimated schedule for the upcoming report, and supplemental compliance evidence where applicable.
FedRAMP is not treating SOC 2 as a badge. It is treating the underlying assurance work as an input into its own certification process.
So the opportunity is not: “We have SOC 2, therefore we have FedRAMP.”
It is: “We have SOC 2. Which controls, assessments and evidence can support Class A, and whatFedRAMP-specific work remains?”
Where ISO 27001 strengthens the picture
ISO 27001 needs to be positioned carefully. Under the current Consolidated Rules for 2026, ISO 27001 is not one of the approved alternative security frameworks for Class A eligibility.
But an established ISO 27001 Information Security Management System can still be highly valuable during readiness. Organizations maintaining both SOC 2 Type II and ISO 27001 frequently have a stronger governance structure around their technical security controls. They may already have formalized risk management, control ownership, policies, internal audits, corrective-action processes, management reviews and continuous-improvement mechanisms.
That can make the FedRAMP gap-remediation exercise considerably more manageable.
A simple way of thinking about it is:
SOC 2 Type II can open the Class A door. A mature ISO 27001 ISMS can make what lies behind that door easier tonavigate.
Leveraging SOC 2 is not the same as SOC 2 reciprocity
FedRAMP Class A does not automatically convert a SOC 2 Type II environment into a FedRAMP-certified environment.
Providers still have to address the applicable Class A requirements and Key Security Indicators. FedRAMP’s July2026 clarification specifically states that Class A providers must address the KSIs even if they ultimately intend to pursue a Rev5 Program Certification path.
Class A also brings requirements that may not exist in the same form within an organization’s commercial compliance program.
These include FedRAMP certification data and information-sharing requirements, Trust Center capabilities, communication processes, assessment scope, ongoing reporting and structured certification information.
Machine readability matters too. When a FedRAMP rule contains a corresponding JSON schema, providers must supply the required information as valid machine-readable JSON unless that rule says otherwise.
So, the opportunity is not to bypassFedRAMP requirements. It is to stop unnecessarily rebuilding security controls and evidence that already work.
The Trust Center is part of the compliance model
The Trust Center is another area where companies should avoid thinking of 20x as simply a lighter documentation exercise.
For Class A, Trust Center capabilities sit within the mandatory rules. The model is designed to make appropriate certification information accessible to the parties that need it while managing restricted information appropriately.
That means the Trust Center is more than a polished web page presenting security credentials. It becomes part of the mechanism through which FedRAMP certification information is made available and maintained. FedRAMP’s Class A rules also call for Marketplace information such as the Trust Center landing page and instructions for accessing its information.
For organizations accustomed to handling security assurance largely through questionnaires, PDFs and one-to-one customer requests, that may require a different operating model.
And Class A begins before the application
There is another prerequisite that can easily be overlooked: The cloud service offering must already be listed in the FedRAMP Marketplace before the provider applies for FedRAMP Certification.
FedRAMP’s current application rules explicitly require Marketplace listing first. That makes Marketplace readiness part of the Class A planning process rather than an administrative task to consider after the certification package is complete.
It also reinforces a larger point:Class A readiness is not simply a control-mapping exercise. Technical readiness, evidence readiness, Marketplace readiness and certification-package readiness need to progress together.
The KendraCyber SOC 2-to-Class A Readiness Approach
For a SOC 2-mature provider, the goal should be to determine which parts of the existing security environment fall into three categories:
- REUSE what already satisfies or supports the FedRAMP requirement.
- ADAPT existing evidence or processes where the underlying capability exists but FedRAMP expects it to be demonstrated differently.
- BUILD only where a genuine FedRAMP-specific gap exists.
Step 1: Determine eligibility and applicability
Start by confirming whether Class A is the appropriate path.
We validate the age and applicability of the SOC 2 Type II assessment, defining the cloud service offering and its boundary, reviewing the existing security architecture and identifying the appropriate FedRAMP Certification Profile.
This is also the stage to consider the longer-term certification path. If federal adoption is the strategic objective, organizations should think beyond obtaining Class A and consider how they may progress toward Class B, C or D.
Step 2: Build the reuse inventory
Next, we identify what the organization already has.
That can include the SOC 2 Type II report and assessment materials, ISO 27001 artifacts where available, policies, architecture documentation, risk assessments, vulnerability-management evidence, IAM controls, logging and monitoring evidence, incident-response processes, penetration testing, secure-development evidence and information held within compliance platforms.
The objective is to establish how much existing security assurance has value within the FedRAMP process.
Step 3: Map SOC 2 against Class A
Next, we map existing controls and evidence against the applicable Class A requirements and Key Security Indicators.
Some requirements may already have strong supporting evidence. Others may have the underlying control but require additional validation, mapping or documentation. And some may represent entirely new FedRAMP-specific requirements.
Step 4: Remediate the actual delta
Once the gaps are understood, resources can be concentrated on them.
Instead of recreating a mature vulnerability-management process, for example, the focus may be on whether the existing process and evidence satisfy the applicable FedRAMP requirement and KSI.
- Where they do, reuse them.
- Where they almost do, adapt them.
- Where there is no equivalent capability, build it.
This is where the potential economic advantage of the 20x model becomes much more tangible.
Step 5: Build the Class A certification package
The next stage turns the organization’s security posture into the structure FedRAMP expects.
The package must include information about the cloud service offering; implementation, validation and assessment information for relevant requirements, controls and KSIs; and a real or exampleOngoing Certification Report.
FedRAMP 20x also uses theCertification Package Overview in place of the historically required base SSP.But that should not be interpreted as eliminating the wider evidence burden.Supporting certification data, mappings, policies, Trust Center material and structured data remain important.
And where a FedRAMP rule has an associated JSON schema, the relevant information must be supplied in the required machine-readable format.
Step 6: Validate, list and apply
The final stage is about ensuring that the package represents the environment as it actually exists today.
FedRAMP requires the initial certification package to show the current state of the cloud service offering as verified and validated by the provider within the previous seven days.
KendraCyber can help assess readiness, perform mappings, identify gaps, prepare materials and support the provider through the process. But the cloud service provider itself must apply forFedRAMP Certification. FedRAMP expressly prohibits providers from using a third party to apply on their behalf.
The CSP remains responsible and accountable for the accuracy and completeness of its certification package.
Certification is the beginning of an operating model
Another misconception worth addressing is that the major work ends once Class A certification is obtained.
Providers must supply an OngoingCertification Report every three months. The report covers changes to certification data, planned changes, accepted vulnerabilities, transformative changes, updated security recommendations or best practices, agencies using the product, reportable incidents and relevant lessons learned.
Incident management also takes onFedRAMP-specific requirements. Providers must evaluate incidents for their potential impact on federal customer data. Under the Class A rules, initial reporting timeframes can be as short as six hours for PAIN-3 through PAIN-5incidents, or one business day for PAIN-1 and PAIN-2, under the applicable reporting rule.
A company should not only ask, “Can we produce the certification package?”
It should ask: “Can our operating model sustain the certification after we receive it?”
Why this can change the economics of FedRAMP
Consider the old mindset:
“We want to sell to federal agencies, so we need to build an entirely separate federal compliance program.”
Now consider the 20x Class A mindset:
“We already have a mature assurance program. How much can we reuse, and what is the incremental work required to satisfy Class A and prepare for the next certification level?”
That turns the exercise from a presumed wholesale implementation into a more targeted reuse + gap remediation + packaging + operationalization program for qualifying organizations.
FedRAMP has not suddenly become effortless.
But the starting line has changed.
And for SaaS companies that have already spent years investing in security maturity, that difference could materially affect the business case for entering the federal market.
Are you a good candidate?
You may be well positioned to explore the Class A pathway if you have a current SOC 2 Type II report, established enterprise customers, mature security operations and vulnerability management, well-developed IAM, logging and incident-response capabilities, and a clearly understood cloud architecture and service boundary.
Having a mature ISO 27001-certifiedISMS can strengthen that position further.
And, most importantly, you now have a strategic reason to enter the U.S. federal market.
If that sounds like your organization, the right first move may not be launching a major FedRAMP implementation - It may be finding out how large your actual FedRAMP delta is.
Class A is an accelerated entry point, not a compliance shortcut
Existing assurance can eliminate unnecessary duplication, but providers still need to demonstrate that their cloud service satisfies applicable FedRAMP 20x requirements and Key SecurityIndicators, establish the required information-sharing and reporting mechanisms, maintain certification data and operate the program on an ongoing basis.
Class A should also be understood in the context of progression. Current agency guidance says agencies should not authorize a Class A service for more than 12 months unless the provider is actively seeking Class B, C or D certification.
And FedRAMP Certification itself should not be confused with winning federal business.
Certification does not itself constitute an agency Authorization to Operate, a federal contract award or a guarantee of federal sales. Individual agencies remain responsible for their authorization and procurement decisions.
What Class A can do is create a more practical entry point into that market for mature providers.
Before you budget for FedRAMP, understand your delta
For SOC 2 Type II companies, FedRAMP20x creates an opportunity to approach federal readiness differently.
Begin with: “What do we already have?”
Then determine what can be reused, what needs to be adapted, what needs to be built, and what needs to be put in place to support the journey beyond Class A.
KendraCyber can evaluate your existingSOC 2 Type II and ISO 27001 environment, assess Class A applicability, map existing assurance against FedRAMP requirements and KSIs, identify the genuineFedRAMP-specific delta, help develop the certification package and support your team in preparing for application and ongoing certification.
The CSP retains responsibility for the application itself. KendraCyber helps make sure the organization is ready to make it.
Already SOC 2 Type II certified?
Before budgeting for a traditionalFedRAMP program, find out how much of your Class A readiness work may alreadyexist and what remains to be done.
Contact KendraCyber for a FedRAMP 20x Class AReadiness and Applicability Assessment.