Which FedRAMP 20X class does my product need?

FedRAMP.gov recommends that most providers entering the federal market start with Class A. The right class ultimately depends on what agency customers require, and each agency makes its own risk decision.

FedRAMP's decision path

FedRAMP.gov offers a simple three-step check:

Cautions

FedRAMP.gov warns providers not to go straight to Class C or D unless an existing agency contract requires that level. Those classes are meant for providers with an active federal customer base and an established compliance program. Classes are designed to be pursued progressively, so investment can grow with agency interest.

Class A is a starting point

Class A is meant to be temporary, and FedRAMP gives Class A providers two years to reach Class B, C or D. Agencies should not use a Class A service for more than 12 months unless the provider is actively pursuing a higher class. For Class D, FedRAMP.gov notes a 20x Class C certification upgraded to Class D can often be faster than Rev5 Class D.

Making the call

Choosing a class is easier with a clear view of how far a system is from each class's rules. Teams commonly work this out with a spreadsheet, a consultant or general-purpose AI. Each helps, but AI draws on general, open sources and a spreadsheet often misses FedRAMP's nuances, so hands-on FedRAMP expertise is still needed to validate the result.