How to Get FedRAMP Certified: The 2026 Path, Class by Class

Key takeaways

• The path is progressive now. You start at Class A with evidence you may already have (a SOC 2 Type II or a recent readiness assessment report), and you climb classes as agency interest grows. The government's own words: your investment can scale with agency interest and resource availability.
• 20x does not require an agency sponsor. The 20x certification type is processed directly by FedRAMP. The old chicken-and-egg problem, no sponsor without certification, no certification without a sponsor, is gone for the 20x path.
• FedRAMP Ready is retired. In July 2026 the program said farewell to Ready as a road to certification. Its replacement is Class A, which accepts a complete Readiness Assessment Report or a SOC 2 Type II, and the pipeline opened August 3, 2026.
• Class B and Class C opened August 31, 2026. Class D (High) is the last to arrive: piloting late 2026, formally available early 2027, and until then Rev5 is the only route to it.
• The 30-day decision is a goal, not an SLA. The program's Getting Certified page is blunt: no service-level agreement, an internal strategic goal, and a clock that stops while the review team waits on you.

What changed, and when

FedRAMP replaced its narrative playbooks with the Consolidated Rules for 2026, officially launched June 24, 2026. Three vocabulary changes matter before anything else:

1. Certification replaces authorization. The program calls its determination a FedRAMP Certification; the agency's own permission to use your service remains a separate authorization (ATO), which agencies still issue.
2. The four classes replace the three impact levels. Class A is the new entry tier. Class B absorbs the former Low (and Li-SaaS) baselines, Class C the former Moderate, Class D the former High.
3. The 3PAO is now the independent assessor. Same role, A2LA accreditation, new name.

The transition dates: Rev5 certifications could adopt the new rules from July 4, 2026, must use them for initial and ongoing certification from January 1, 2027, and the grace period ends June 1, 2027. FedRAMP stops accepting new Rev5 certifications on June 11, 2027.

Choose a type first: 20x or Rev5

The government's guidance is direct: for an existing commercial cloud service, 20x is the fastest and cheapest way into the federal market, and a provider starting from zero can usually reach a 20x Class C and then upgrade toward Class D faster than chasing a Rev5 Class D today.

The four classes, and where to start

The classes are a ladder. Each step up raises the same six dials the government lists: preparation, federal process maturity, automation, verification and validation, agency assurance, and cost.

Start at Class A in most situations. The government says exactly that, and it adds a warning worth quoting: be careful starting with Class C or Class D. The higher classes commit you to more preparation, more automation, and tighter ongoing obligations before you have a single federal customer.

One clock starts at Class A: once a federal customer is using your service, you have 12 months to begin the transition to Class B or higher. The entry tier is a runway, not a parking spot.

The journey itself: three stages, one application

The program draws the path as three stages: Preparation, Initial Implementation, and Ongoing Certification.

Preparation is where the time actually goes: reading the rules (they are published as machine-readable JSON, and the human pages are reference copies), building your evidence, and engaging an independent assessor, which every provider must work with.

Initial Implementation ends in the application. The rule is IFP-APP-AFC, Applying for FedRAMP Certification, and the program describes the review honestly:

• A cursory scan confirms the submission is complete.
• A Review Team is assigned and requests access to your trust center materials.
• The team reviews your Certification Package Overview. For 20x, expect a Deep Dive with your team on the package and your Security Decision Record.
• The clock stops while the team waits on you.

The goal is an initial decision within 30 days. The same page says plainly that you may have heard the review could take a year or more, that the program offers no SLA, and that 30 days is its internal strategic goal. Plan for the preparation months, not the review weeks, to be your timeline.

Ongoing Certification is the part the old guides understate. It includes the incident reporting clocks keyed to your class and the incident's severity, quarterly review meetings, and the Ongoing Certification Report, the successor to the old continuous-monitoring packages (what changed in monitoring).

What the old guides get wrong

• "You need an agency sponsor first." True for Rev5, not for 20x.
• "Plan on 10 to 19 months." That describes the legacy path's totals. The class ladder plus the 30-day decision goal changes the shape: your preparation is the variable, the review is not.
• "Get FedRAMP Ready first." Ready retired in July 2026. Its work product did not: a recent Readiness Assessment Report is one of the two Class A entry tickets.
• "Low, Moderate, or High?" The question is now A, B, C, or D, and the answer for most entrants is A.

Frequently asked questions

Which class should I start with? Class A in most situations, per the government's own guidance, using a SOC 2 Type II or a recent Readiness Assessment Report. Start higher only when you already have federal demand that requires it, and read the government's caution about starting at C or D.

Do I need an agency sponsor? Not for 20x. Rev5 typically still requires one, and Rev5 remains the route for services on their own infrastructure or needing Class D before the 20x Class D pipeline opens in early 2027.

How long does it really take? The program's goal is an initial decision within 30 days of a complete application, with no SLA and a clock that pauses on you. Your preparation, evidence, and automation maturity are the real timeline. Published estimates for the full journey still run from several months to two-plus years depending on class and starting maturity (where the numbers come from).

What happened to FedRAMP Ready? It retired as a road to certification in July 2026 and appears on the marketplace as a legacy designation. Recent Readiness Assessment Reports remain viable as Class A entry evidence.

What does certification obligate me to afterward? Ongoing certification: the class-keyed incident reporting clocks, quarterly review meetings with the government, the Ongoing Certification Report, and keeping your trust center current. The class you pick sets how tight those clocks run.

When your certification work needs assessors or advisors, choose from the firms the government itself lists. Not sure where you fit? Try the five-question Firm Finder first.