Does our SOC 2 or ISO 27001 work count toward FedRAMP?

A recent SOC 2 Type II can count, but only toward a Class A certification. FedRAMP's current rules do not list ISO 27001 as an accepted framework.

SOC 2 Type II and Class A

Class A is FedRAMP's entry-level class, meant for pilots and very low-risk uses. A Class A applicant must have completed SOC 2 Type II, GovRAMP (formerly StateRAMP) or FedRAMP Rev5 within the past 12 months. SOC 2 applicants must supply the full report, any bridge or gap letter, audit engagement documentation and a schedule for the next report.

No bridge to higher classes

FedRAMP states it is "not providing a bridge from external frameworks to other classes of FedRAMP Certification." It adds that "no reciprocity is intended or will be granted." Class A is meant to be temporary, and providers get two years to reach Class B, C or D.

ISO 27001

An earlier FedRAMP proposal, RFC-0022, listed ISO/IEC 27001 among possible frameworks. The final outcome named only SOC 2 Type II as the initial 20x framework. FedRAMP says other frameworks may be added over time, based on demand.

Reusing the work

Even when a framework does not count formally, its evidence can still help. FedRAMP's help center advises mapping SOC 2 evidence to each FedRAMP rule rather than pointing to the report. That mapping is often where DIY efforts stall, since FedRAMP is more nuanced than SOC 2 or ISO 27001, and a gap analysis is a common way to see what carries over.