FedRAMP now certifies by class, and the class is what sets the number. Class A is a SOC 2 plus package work. Vendor estimates put assessment and readiness work at $90,000 to $100,000, most of it a SOC 2 and readiness work, with weeks of FedRAMP review. Class C is $170,000 to $200,000 plus a year of internal engineering. Class D has no class-specific ruleset published, so it has no number.
Those figures are lower than the ones this site published under the old tiers, and the reason is not a correction of an error. The evidence model changed.
Ask five vendors what FedRAMP costs and you get five numbers. In 2026 most of them describe a framework that no longer exists.
What actually changed
Three things, and they are easy to confuse.
The rules. The FedRAMP Consolidated Rules for 2026 replaced the program's narrative documents with 245 rules, 136 of them MUST requirements. They were published in June 2026, become mandatory on 1 January 2027, and replace the system security plan with a certification package and a security decision record. The old POA&M becomes "accepted vulnerabilities".
The certification types. There are two. Rev5 is the legacy type, open for new applications until 11 June 2027. 20x is the current type. The rules govern both, so 20x is not a synonym for the 2026 rules. It is one of the two ways to be certified under them.
The classes. Every certification is now described by class, A through D. The class replaced the impact level as the name of the thing you buy, and the old levels survive in two places: as Rev5 legacy certifications, and as the way agencies categorize their own systems.
One detail that catches people who think they already know the mapping: LI-SaaS did not become Class A. FedRAMP's marketplace carries the 42 legacy LI-SaaS records as Rev5 Class B. FedRAMP Ready is the designation that became Class A, and Ready stopped accepting submissions on 28 July 2026.
The four classes
| Class | What it covers | How it is certified | Independent assessor | Status |
|---|---|---|---|---|
| Class A | Most non-sensitive use cases, and some Low, Moderate or High objectives | 20x program certification, no sponsor needed | Optional | Open since 3 August 2026 |
| Class B | Most Low objectives, and some Moderate or High | 20x program certification, no sponsor needed | Required | Open since 31 August 2026 |
| Class C | Most Low and Moderate objectives, and some High | 20x program certification, no sponsor needed | Required | Open since 31 August 2026 |
| Class D | Class-specific ruleset not published | Programme certification, announced for 2027 | Expected to be required | Expected in 2027 |
Two things in that table are worth pausing on. None of the 20x classes A through C needs an agency sponsor. The sponsor model belongs to the Rev5 agency path, which is closing. And Class D has no ruleset, so any detailed claim about what it requires is speculation.
What each class costs
FedRAMP publishes no prices. Its own class comparison has a cost row with no values in it. Every figure below is a vendor estimate or a planning range, and the internal line is the one that decides the project.
| Class | Vendor estimate: assessment and readiness | Internal time | Time to certification | Annual, ongoing |
|---|---|---|---|---|
| Class A | $90,000 to $100,000 | 200 to 400 hours ($40,000 to $80,000) | 90 to 120 days readiness, then 17 to 28 days review | SOC 2 re-attestation, about $20,000 to $40,000 plus staff |
| Class B | $125,000 to $135,000 | 400 to 800 hours ($80,000 to $160,000) | 3 to 6 months | Annual assessment and staff |
| Class C | $170,000 to $200,000 | 1,000 to 2,000 hours ($200,000 to $400,000) | 6 to 12 months | Annual assessment, tooling and one FTE |
| Class D | Not published | Not published | 2027 at the earliest | Not published |
The first column is a vendor estimate that bundles assessment and readiness work. It is not an assessor-only fee: an assessor is optional at Class A and mandatory at B and C, and a good part of the Class A figure is the SOC 2 audit you may already be paying for. It is not a FedRAMP figure, and the spread across vendors is wide enough that you should get three quotes. The internal column values those hours at $200, the same loaded rate the productization cost model uses.
Why these are lower than the Rev5 numbers. The ranges this site used to publish were Rev5 ranges: $150,000 to $400,000 for the Low-equivalent class, $500,000 to $1.5M for Moderate, $1.5M and up for High. Those described an assessment of a control baseline, documented in a system security plan that could run to hundreds of pages. The 20x model asks for measured outcomes against a smaller set of indicators, validated with automation, in a machine-readable package. Assessors working on 20x report materially lower assessment effort, and the published estimates reflect it. The old numbers are not wrong for a Rev5 certification. They are wrong for a new one.
Class A: what the money buys
Class A is the entry class, and it is a different kind of purchase from the old tiers.
The prerequisite. A SOC 2 Type II issued within the last twelve months, a completed FedRAMP readiness assessment, or a GovRAMP certification at any level. A current SOC 2 makes you eligible to apply. It does not satisfy the indicators by itself.
The work. Seven named Key Security Indicators, sixteen named rules, a machine-readable package that validates against FedRAMP's schemas, a trust center, and quarterly reporting. The trust center is not optional decoration; the review team reads it.
What it does not buy. A SOC 2 is an input, not a certification. Holding one does not make you FedRAMP certified, and it does not produce a marketplace listing or an authority to operate. Class A is the certification; the SOC 2 is the evidence that gets you reviewed.
How long it takes. Faster than the old framework, and faster than most vendors will tell you. Four providers were certified within weeks of the pipeline opening in August 2026, and the observed runs from "in process" to certified were 17 to 28 days. FedRAMP's own review target is 30 days from a complete application. The 17 to 28 days is the review queue. The 90 to 120 days in the table is your preparation, and it is the longer half.
The annual cost. Class A's ongoing obligation is to keep the underlying framework current. In practice that means an annual SOC 2 re-attestation and the quarterly reports, though the rule does not itself mandate an annual SOC 2. There is no annual FedRAMP assessment and no assessor to pay. That is the single biggest cost difference between A and the classes above it.
The 12-month rule is worth knowing here. Agencies should not authorize a Class A service for more than twelve months unless the provider is actively seeking a higher class. The clock starts with the first federal customer, not with certification, so a Class A certificate is a runway rather than a destination.
Class C: what the money buys
Class C is where most products land when the data is sensitive or a customer demands more. It is the Moderate-equivalent project, and it is the one that consumes a year of calendar for four to eight months of work.
The work. All 46 Key Security Indicators, at least two automated verification methods for each, an independent assessment covering every indicator annually, a package, and ongoing reporting. The automation requirement is the part that changes engineering: Class C is not a documentation exercise with a scanner attached. It expects the controls to be evidenced continuously.
The cost split. The assessment is the visible line and usually the smaller one. The internal engineering is the larger, and it does not appear on an invoice. For a firm with a weak starting posture, expect the equivalent of one to two engineers for most of a year.
The annual line. An independent assessment every year, plus the tooling and the staff to keep the evidence current. Budget it from the start. Firms that budget the certification and not the annual assessment discover the gap in year two, and it is usually the year the product stops being funded.
Class B and Class D
Class B is the narrow middle: most Low objectives, some Moderate, an assessor and all 46 indicators, with one automated method each rather than two. Third-party cost is estimated at $125,000 to $135,000. It is also where every legacy LI-SaaS authorisation now sits, whether or not the provider chose it. Which class you need covers the choice.
Class D has no class-specific ruleset published, no published requirements and no price. The 20x Class D path is announced for 2027. A customer who needs that level of assurance today is choosing between a Rev5 certification and a Class C certification with agency-specific overlays, and the class guide walks that decision.
Ongoing certification, not continuous monitoring
Continuous monitoring survives as a ruleset name. The 2026 rules put it under a broader umbrella called ongoing certification, which is more specific than a monthly scan.
- Reporting every three months, not monthly, in a human-readable form, with the next report date published.
- An annual independent assessment for Classes B, C and D, covering every indicator. Class A meets its annual obligation through the underlying framework instead.
- Significant change notification for the changes the rules define, and a class change requires a new assessment rather than a notification.
- Accepted vulnerabilities replace the POA&M. A template that still asks for a POA&M, or for accepted weaknesses, is a legacy template.
What it costs. At Class C, one full-time equivalent of compliance effort is a realistic planning number, plus tooling and the annual assessment. At $200 an hour that is roughly $416,000 a year, and it is the line that decides whether the product survives. If you cannot carry it out of revenue, the product is not ready for Class C.
The five-year test
Before any of this, model the whole thing. Projected five-year revenue must be at least five times the five-year cost of certification, assessment, tooling and engineering.
Class A. Year one is $130,000 to $180,000, third-party plus internal. Add four years of SOC 2 re-attestation and staff at roughly $100,000 a year, and the five-year total is about $530,000 to $680,000. Five times that is $2.65M to $3.4M of revenue to justify. At an annual contract value of $50,000, that is 53 to 68 customer-years, or eleven to fourteen customers held for five years.
Class C. Year one is $370,000 to $600,000. Add four years of an FTE, tooling and the annual assessment at roughly $470,000 to $520,000 a year, and the five-year total is about $2.2M to $2.7M. Five times that is $11M to $13.5M of revenue. At $50,000, that is 220 to 270 customer-years, or 44 to 54 customers held for five years.
If you cannot name the first three of those customers, do not certify. The free HARBOR Signal diagnostic tells you whether your firm is ready to take on a program of this size at all. Many are not yet, and the honest answer is worth more than a proposal.
Three ways vendors overpay
Buying the wrong class. Class C costs three to five times what Class A costs over five years, and it buys assurance a customer may not have asked for. Let the requirement pick the class, not a vendor's tier list.
Budgeting a control count. The 20x classes do not use a control count. They use 46 Key Security Indicators mapped to 302 unique SP 800-53 controls. A provider that budgets from "Moderate is 323 controls" is estimating a framework that is not being assessed, and the number gives a false sense of precision. The Rev5 baselines do carry control lists, which is one reason Rev5 and 20x cost different amounts for the same outcome.
Missing the annual line. The initial certification is the visible number. The annual assessment, the tooling and the staff are the number that decides whether the product survives.
None of this is legal or procurement advice, and none of it replaces a scoping conversation with your assessor. It is the shape of the decision, and the shape is what a budget has to survive.
If the question is still which class, read that guide first. If you need a vehicle as well, selling software to the federal government covers it.