Evidence with context
Organize assessment materials and link the supporting artifacts to your responses. Make the implementation understandable without asking reviewers to search an entire audit report.
SOC 2 → FedRAMP 20x Class A
Your SOC 2 investment.
A path into federal.
You’ve built a security program. Put it to work in a new market. FedRAMP Class A gives eligible SOC 2 Type II companies a practical starting point. Boundera helps you prepare the submission.
Target: submission-ready in under a week.
For eligible teams with evidence and prerequisites in place. See how preparation works.
Your federal starting point01 → 02
THE WORK YOU ALREADY DID
FoundationSOC 2 Type II
Your report. Your evidence. Your security program.
Prepared with Boundera
YOUR NEXT MILESTONE
AClass A submission package
Certification Package OverviewThe offering, scope, and key facts
CPOSecurity Decision RecordClass A responses and linked evidence
SDRTrust CenterA controlled place for reviewers
Prepared for your review and submission
Illustrative preparation workflow. FedRAMP makes the certification decision.
BUILD ON WHAT YOU HAVESOC 2 Type II accepted
Completed within the past 12 months.
CLASS A ASSESSMENTNo additional independent assessment required
FedRAMP still reviews your submission.
FEDRAMP 20x PATHNo agency sponsor required
Apply directly through Program Certification.
A different starting point
Your audit gives you
something to build on.
Class A recognizes an existing commercial assessment. Your next task is to turn that evidence into a clear, current FedRAMP package and address the federal requirements around it.
Read the Class A rulesA good fit starts with
A current SOC 2 Type II
The assessment was completed within the past 12 months and covers the offering you want to take federal.
The full assessment materials
Your complete report, any applicable bridge or gap letter, audit engagement records, and next-report schedule.
A team ready to close the gaps
Owners who can explain security decisions, address Class A requirements, and keep the evidence current.
From evidence to application
Aim for submission-ready.
In under a week.
A focused preparation target for teams whose evidence and Marketplace prerequisites are ready. We confirm scope first; implementation gaps and missing records can extend the work.
- 01
Confirm the fit
Review your SOC 2 scope, report date, federal use case, and Marketplace listing status.
YOU LEAVE WITHAn agreed Class A plan - 02
Connect the evidence
Organize your assessment materials, explain the Class A requirements, and identify what still needs work.
YOU LEAVE WITHEvidence mapped to the requirements - 03
Prepare the package
Assemble the CPO and SDR, check schema validity, and set up access to the supporting records.
YOU LEAVE WITHA reviewable package and Trust Center - 04
Review, then apply
Your team confirms the records and submits FedRAMP’s application once the Marketplace prerequisite is met.
YOU LEAVE WITHYour application to FedRAMP
This is the preparation timeline. FedRAMP reviews the application and decides certification on its own schedule. A Marketplace listing must be in place before you apply.
Application requirementsThe work behind the submission
Give reviewers
a clear record.
Bring the commercial evidence forward. Explain the federal requirements. Keep the package and its supporting records connected in Boundera.
What FedRAMP expects in the packageYour CPO and SDR
Assemble the offering overview and security decisions in human- and machine-readable form, with applicable rules, implementation status, and required report samples.
A maintained Trust Center
Give authorized reviewers a place to access the package. Keep vulnerability and incident reporting workflows alongside the records you maintain.
A practical first investment
Start with Class A.
Make room to grow.
A defined annual plan for companies bringing an existing SOC 2 Type II into FedRAMP. Build your federal foundation, then expand the program as your customers need more.
Your first year credits toward Class B.
Exploring the opportunity first? Our self-serve Marketplace listing workflow is free.
BOUNDERA · EXTERNAL FRAMEWORKS
Class A
$5,000/ year
For providers with an existing SOC 2 Type II.
- SOC 2 Type II evidence intake
- FedRAMP Certification Package assembly
- Trust Center and Marketplace materials
- Incident and vulnerability reporting workflows
Boundera’s annual plan fee. FedRAMP makes the certification decision; scope and preparation timing are confirmed together.
The next chapter
Grow into Class B or C.
Keep building on your work.
The FedRAMP 20x Program Certification path lets you pursue the next class without an agency sponsor or prior agency ATO. Prepare the additional evidence and required independent assessment for that class.
YOUR STARTING POINTACommercial evidence.
Commercial evidence.
Federal foundation.
Maintain your package in Boundera.
Class B
Build out the applicable KSI evidence and independent assessment.
Evidence Workspace from $25k/yearClass C
Expand validation and evidence depth for the Class C requirements.
Evidence Workspace from $45k/yearFedRAMP Certification supports the agency’s decision. Each agency still authorizes its own use of your service.
Before you make the move
A few clear
answers.
Know what carries forward, what comes next, and who makes the final decision.
Does any SOC 2 report qualify?
This path accepts SOC 2 Type II, with the assessment completed within the past 12 months. A Type I report alone does not qualify. We review the offering's scope and the available assessment materials before planning your Class A work.
Official guidanceDo we need another independent assessment for Class A?
A separate FedRAMP independent assessment is optional for Class A. Your existing SOC 2 assessment supplies the external assurance foundation. You still need to address the applicable Class A requirements, prepare the package, and go through FedRAMP's review.
Official guidanceCan we really be ready in under a week?
That is our preparation target for eligible teams with a current report, complete evidence, available decision-makers, and Marketplace prerequisites in place. We confirm the scope first. Missing evidence or implementation work can extend preparation. FedRAMP's review, certification decision, and agency authorization run on their own timelines.
Is a Marketplace listing the same as Class A Certification?
They are separate milestones. A provider must be listed in the Marketplace before applying for certification. An Initial Implementation listing makes your offering and progress visible; it does not mean FedRAMP has issued a Class A Certification.
Official guidanceDo we need an agency ATO to move to Class B or C?
On the FedRAMP 20x Program Certification path, you can pursue Class B or C directly through FedRAMP without an agency sponsor or a prior agency ATO. The higher class requires its own evidence and independent assessment. An agency still makes its own decision about authorizing and using your service.
Official guidanceCan we stay on Class A as federal business grows?
Plan for the next class as agency needs grow. FedRAMP's published guidance says that once a federal customer uses the service, the provider has 12 months to begin transitioning to Class B or higher. We can help you plan that work from the records you maintain in Boundera.
Official guidanceBring your SOC 2. Let’s plan what’s next.
Make federal
your next market.
Walk through your offering, existing evidence, and Class A fit with us.
Plan your Class A entryRules reviewed October 12, 2026.Class A requirementsAgency use of 20x packages