Which FedRAMP certification class do you need? A, B, C or D

Start at Class A unless you handle controlled unclassified information or sensitive personal data at scale, or a named customer has told you it needs more.

That is the answer for most small firms, and it is the one FedRAMP gives: Class A is designed for existing commercial products with a SOC 2 Type II, and it is the simplest way to become certified in order to win a customer.

The harder cases are the ones this page is for. FedRAMP now certifies by class, A through D, instead of by impact level, and the mapping from the old levels is close enough to be useful and loose enough to be dangerous.

The four classes in one table

FedRAMP Ready stopped accepting submissions on 28 July 2026, and FedRAMP now points providers at Class A instead. The 2026 rules become mandatory on 1 January 2027, and new Rev5 certifications close on 11 June 2027. Most new products start under the classes; Rev5 remains open until 11 June 2027, and it is closing.

The indicator counts matter more than they look. Class A asks for seven named indicators and sixteen named rules. Class C asks for all 46. Class B asks for 41, with five optional, and its automation bar is a SHOULD of one method per indicator where Class C makes two a MUST.

The mapping is a translation, not an equivalence

It is tempting to read the table as A equals Ready, B equals Low, C equals Moderate and D equals High, then pick the tier you already planned. The mapping is a descent, not an equivalence.

FedRAMP's marketplace designations page labels the comparison "Historical Rev5 Categorization" and says the classes indicate "the depth of information provided in your certification package, not the security level of your product". The class guidance says the classes "loosely align" with the FIPS 199 impact levels and that "there is not a direct correlation". The agency guidance tells agencies not to treat the classes as one-for-one replacements for Low, Moderate or High.

So the mapping is the migration path, and the disclaimers are the warning. Agencies still categorize their own systems under FIPS 199. The classes align approximately with the NIST SP 800-53B baselines for those levels, and a provider can tailor a baseline. Two Class C certifications do not implement identical controls, and a Class C certificate does not guarantee an agency will accept the service for a moderate system.

What follows from that: the class is evidence, and the authority to operate is the agency's decision. The authorizing official weighs the evidence against the system.

The three tests that decide it

1. What data does the product touch?

This is the first filter, and it settles most cases.

If the product handles controlled unclassified information, sensitive personal data at scale, or data an agency treats as moderate impact, you are in Class C territory. If it handles only low-impact data, public information, or non-sensitive operational data, Class A is probably enough.

One trap in the old vocabulary: the retired low-impact SaaS designation did not become Class A. FedRAMP's marketplace carries those legacy records as Rev5 Class B. If you hold one, you are already in the B world, and the question is whether to move to 20x B before Rev5 closes in June 2027.

2. What does the product connect to?

A product that sits beside an agency system with a narrow, well-documented interface is easier to place than one that becomes part of the agency's authentication or data backbone.

If your service is a component that inherits controls from a moderate-baseline system, the agency may need Class C evidence to accept the inheritance. If it is a standalone tool with an API and no privileged position, Class A can be enough even inside a larger moderate system. Architecture changes the answer, which is why the Risk-Proof stage treats certification and architecture as one decision.

3. What has a customer actually required?

The strongest signal is a solicitation, a contract clause or a written statement from an agency that names the assurance it needs. A program manager's enthusiasm is not a requirement. A security questionnaire is not a requirement. A clause is.

If the requirement names FedRAMP Moderate, Class C is the evidence that matches. Confirm with the authorizing official, because agencies are told not to treat classes as one-for-one replacements and may accept less with compensating controls. If it says the product must be FedRAMP certified without naming a class, ask which class the authorizing official will accept. The answer decides your budget.

Class A or Class C is the real decision

Class B sits between them, and most firms skip it. The choice that matters is the two ends.

Class A asks for evidence you may already hold. Seven indicators, fourteen rules, a package, a trust center and quarterly reports. A current SOC 2 makes you eligible to apply, not close to certified: the indicators still have to be evidenced. There is no mandatory assessor, and the annual obligation is to keep the SOC 2 current.

Class C asks you to build a compliance operation. All 46 indicators, two automated verification methods each, an independent annual assessment, and the staff to keep the evidence current. It consumes a year of calendar for four to eight months of work, and it is not a documentation project.

The gap is not a slightly bigger checklist. It is a different kind of program, and the cost difference is three to five times over five years once internal time is counted. If Class A can carry the sale, take it and revisit C when a customer requires it. If the customer requires more, Class A will not substitute, and pretending otherwise costs a year.

Why Class B is rarely chosen

Class B covers most Low objectives and some Moderate ones. It requires an independent assessor and all 46 indicators, with one automated method each.

If a product qualifies for Class A, Class B buys assurance the customer did not ask for at the price of an assessment. If a product needs more than Class A, the requirement is usually CUI or a moderate system, which points at Class C. The middle is narrow: a customer that needs more than a SOC 2 but will accept less than the Class C baseline, and will not move on it.

The exception is a provider with a legacy low-impact designation, which now sits in Class B whether or not it chose to be there.

When only Class D works

Class D is the highest class short of classified systems. FedRAMP expects to make it available in 2027, and no Class D ruleset is published, so the requirements and the cost are unknown. Nobody is choosing it today.

The question is what to do if a customer demands that level of assurance now. Three options, in order of preference. Ask whether the agency will accept Class C with agency-specific overlays; often the requirement is a baseline plus additions rather than the full class. Ask whether a Rev5 certification is acceptable, because those remain available until 11 June 2027. Or treat the program as a 2027 project and say so, because a timeline that assumes Class D today is not a plan.

The customer test, not the sponsor test

The old advice was to find an agency sponsor. Under the 2026 rules that advice is out of date for 20x. Classes A, B and C are program certifications: you apply to FedRAMP directly, with no agency sponsor. The sponsor model belongs to the Rev5 agency path, and that path closes with Rev5 on 11 June 2027.

What you still need is a customer. Certification is evidence; an agency still has to authorise the service for its own system, and an authorizing official still has to accept it. Without a customer, you can be certified and unsold. That is a legitimate strategy for Class A, which is cheap enough to hold while you sell, but the 12-month agency clock starts with the first customer, so the runway is real rather than indefinite. It is an expensive one for Class C.

So the test is not "who will sponsor me". It is "who will use this, in which system, and what will their authorizing official accept". If you cannot answer that, Class A is the honest starting point, and the first sale is the work.

The decision tree

• No agency customer, low-impact data, standalone service: Class A. Get certified, then sell.
• No agency customer, CUI or sensitive PII: do not certify yet. Class A is not adequate for CUI, so wait for a customer commitment and then go to Class C. Do not use Class A as a placeholder.
• No agency customer, but the service will inherit moderate-baseline controls: Class C when the customer commits. Class A alone may not satisfy the inheritance, which is why the second test matters.
• A named agency requires Moderate or CUI handling: Class C, with that agency as the customer and the authorizing official as the reviewer.
• A named agency needs more than Class A but will accept less than Class C: Class B, if the requirement is written down.
• A named agency demands the highest assurance: Class C with overlays, or a 2027 Class D program. Do not promise a date you do not control.
• You hold a legacy low-impact designation: you are already in Rev5 Class B. New Rev5 applications close on 11 June 2027, and existing certifications remain valid while the migration paths are published.

What it costs, and what to do next

The class sets the budget, and the budgets are far apart. Class A is about $90,000 to $100,000 in assessment and readiness work plus internal time. Class C is $170,000 to $200,000 plus a year of engineering, with an annual cost attached. What FedRAMP actually costs has the ranges, the internal time and the five-year test.

Two things are worth doing before either. Run the free HARBOR Signal diagnostic to see whether your firm is ready for a certification program at all, and write down the three tests above with your answers. If you cannot describe the data and the connection, the class is not the open question.

One caution on the old vocabulary. The impact levels still appear in solicitations, in agency questionnaires and in vendor proposals, and they will for a while. When you see "FedRAMP Moderate", read it as Class C unless the document says otherwise, and confirm with the authorizing official rather than assuming. The mapping is close enough to translate and loose enough to cost you a year if you treat it as exact.