Certification Classes are FedRAMP's four levels of assurance, from minimal assurance at Class A to significant assurance at Class D. They replace the old Low, Moderate and High impact levels, though not one-for-one.
What a class measures
A class describes how much assurance information a provider gives agencies about its security. FedRAMP.gov stresses that classes "indicate the level of assurance provided, not the level of security or protection provided." Higher classes provide more assurance and cost more to reach.
How the classes compare
Each class has its own requirements. A Key Security Indicator (KSI) is one of the security outcomes a 20x provider must show, and higher classes must check more of them automatically.
| Class | FedRAMP.gov presumes it is adequate for | Key requirements |
|---|---|---|
| A | Pilots, configuration and testing, or extremely low-risk uses, such as public information | A SOC 2 Type II, GovRAMP or FedRAMP Rev5 certification completed in the past 12 months. Independent assessment optional. KSI automation optional. |
| B | Most Low impact agency systems | Independent assessment within the previous 3 months. At least 1 automated check per KSI recommended. |
| C | Most Low or Moderate impact agency systems | Independent assessment within 3 months. At least 2 automated checks per KSI required. |
| D | Most agency systems, regardless of impact level | Independent assessment within 3 months. At least 4 automated checks per KSI required. |
- FedRAMP.gov presumes it is adequate for
- Pilots, configuration and testing, or extremely low-risk uses, such as public information
- Key requirements
- A SOC 2 Type II, GovRAMP or FedRAMP Rev5 certification completed in the past 12 months. Independent assessment optional. KSI automation optional.
- FedRAMP.gov presumes it is adequate for
- Most Low impact agency systems
- Key requirements
- Independent assessment within the previous 3 months. At least 1 automated check per KSI recommended.
- FedRAMP.gov presumes it is adequate for
- Most Low or Moderate impact agency systems
- Key requirements
- Independent assessment within 3 months. At least 2 automated checks per KSI required.
- FedRAMP.gov presumes it is adequate for
- Most agency systems, regardless of impact level
- Key requirements
- Independent assessment within 3 months. At least 4 automated checks per KSI required.
An independent assessment is a review by an assessor that FedRAMP recognizes. Some Moderate or High uses of Class B or C services are possible with compensating controls.
Where things stand
20x currently offers Classes A, B and C. FedRAMP expects to pilot 20x Class D in late 2026 and offer it formally in early 2027. Until then, Rev5 is the only route to Class D.
Sources
Related Articles
- What is FedRAMP 20X, and how is it different from Rev5?
- Does my SaaS company need FedRAMP to sell to federal agencies?
- Which FedRAMP 20X class does my product need?
- What are Key Security Indicators (KSIs) in FedRAMP 20X?
- What are the FedRAMP 2026 Consolidated Rules?
- What does continuous validation mean in FedRAMP 20X?
- What's the difference between FedRAMP and SOC 2?
- Does our SOC 2 or ISO 27001 work count toward FedRAMP?
- Do I need an agency sponsor for FedRAMP 20X?