In the past, FedRAMP has used impact levels as a sort of classification system for cloud services that wish to work with the government in some capacity.
The impact levels evaluate a cloud service provider (CSP) based on the sort of information they would be handling and the service they would provide to the government. They are classified across three axes: confidentiality, integrity, and availability.
The impact levels started at Li-SaaS, a low impact classification for services that technically handle CUI, but only in the form of authentication information. Then there were the three main classifications: Low, Moderate, and High.
We've covered all of this in the past, but it's time for a revisit, because with FedRAMP 20x, things are changing.
BLUF - Bottom Line Up Front
FedRAMP moved from impact levels (Li-SaaS, Low, Moderate, High) to Certification Classes A–D, where classes measure assurance, not security. Class A serves as an on‑ramp for pilots and SOC 2 holders. Class B fits many low and some moderate needs with extra controls. Class C fits CUI or financial data, needs automation and higher assurance. Choose the minimum viable class and move up as needed.
Out with Impact, In with Class
When FedRAMP 20x was first being piloted and discussed, there was a lot of confusion over the change from Impact Levels to the new Certification Class system.
Initially, many people thought that it was basically a change in terminology. Li-SaaS became Class A, Low Impact became Class B, Moderate Impact became Class C, and High Impact became Class D.
The reality is, while this is vaguely true in an abstract sense, there's actually a lot more detail to the shift, and a lot of change under the hood that is very meaningful to your decision. In fact, FedRAMP makes a point to say that the Class system is not a measure of security, but rather of assurance.
"FedRAMP Certification Classes are not aligned to how secure a cloud service offering is!
Certification Classes indicate the level of assurance provided, not the level of security or protection provided! Obtaining and maintaining a FedRAMP Certification is a heavy investment for cloud service providers, and many cloud services with world-class security programs are only willing to invest in Class A or B FedRAMP Certifications to keep government pricing aligned with commercial pricing."
Impact Levels still exist, but they are now internal to government agencies. A government agency that needs an external service will classify their needs under the Impact Level system, and then use that to guide the kinds of CSPs they can shop for in the FedRAMP marketplace.
As a CSP seeking certification, you have to decide which certification class you want to pursue. That means you need to know what level of security you'll need.
"Each FedRAMP Certification Class provides progressively more assurance, commitment, and alignment with diverse agency needs; this requires additional preparation, familiarity with the federal process, and investment at every stage."
Before you pick a class to start, there's one important thing to know about the new class system that wasn't really true under the former impact level system.
It's designed for mobility.
Under the impact level system, if you had a Low Impact ATO, transitioning to a Moderate Impact ATO meant basically going through the whole authorization process again. You had a foot in the door by already having an ATO, a government agency sponsor, and some familiarity with the process. But you still had to identify the hundreds of additional security controls, implement them properly, document them accordingly, and pass a new assessment to earn a new ATO.
This meant that your decision was an important choice when you started out. It's also why over 80% of FedRAMP authorizations were at the Moderate level; very few CSPs needed High, while very few agencies needed Low CSPs that weren't already filled by existing companies in those niches.
With the class system, the goal is to function more as an on-ramp. Class A is a very small-scale, low-stakes certification, but it's designed to smoothly transition into a Class B, which in turn makes it easier to achieve Class C. Presumably, the same will be true of Class D, though Class D does not wholly exist yet, and won't until the pilot is completed sometime next year.
Where to Start with FedRAMP 20x Certification?
Right now, you basically have three ways to start with FedRAMP 20x.
You can:
- Start with a Class A certification and build up to the level necessary for your clients.
- Start with a Class B certification and build up if necessary.
- Start with a Class C certification.
You cannot currently start at Class D, or even achieve Class D, but when it's trialed and proven, it will be available. But the chances of you needing to start at Class D are slim to none, so it's not worth dedicating space to in today's discussion.
None of these is a bad starting point, depending on your situation. So, let's go through each of the options and discuss when it's a good idea.
When to Start with Class A Certification
The FedRAMP Class A certification is designed to be a small-scale, introductory certification.
It has the lowest number of security controls, the lowest requirements, and the lowest financial investment.
"Class A Certifications are Adequate for use in pilots, during configuration and testing, or for extremely low or negligible risk use cases such as processing public information or getting started with very few users."
One of the biggest benefits of a Class A certification is that it's specifically designed as an on-ramp into the FedRAMP ecosystem. In fact, it was designed to have overlap with SOC 2 in a specific way such that, if your CSP already has a SOC 2 report, it gets you a lot of the way towards succeeding with Class A in FedRAMP. We wrote a whole guide to this specific interaction not long ago.
Class A is a great starting point if you already have a SOC 2 report, if you're hoping to pilot an introductory version for a small client list, or if you're just trying to get your feet wet before diving into the FedRAMP ecosystem.
In fact, starting with Class A is FedRAMP's recommendation for newcomers to the world of government contracting.
"In most situations, cloud service providers that are looking to enter the federal market should start with a FedRAMP Class A Certification, which is designed for existing commercial products that already have a SOC 2 Type II certification and a mature security program."
On the other hand, if you know you want to end up at a higher certification class, have existing government contracts that will want a higher level of assurance, or you already have an existing FedRAMP ATO under the Rev5 rules and want to convert to 20x at a higher class, you should go for one of the other options.
When to Start with Class B Certification
The FedRAMP Class B certification is the first of the "at rest" certifications. That's not an official descriptor, but more of a design philosophy.
Where Class A is not the kind of certification you use as your business grows or you expand your contracts, Class B can be the class you use indefinitely.
"Class B Certifications are Adequate for use in most Low Impact agency information systems and some Moderate or High impact agency information systems with appropriate compensating controls."
Class B takes more time, more money, and more effort to achieve. It involves more security controls and a higher degree of assurance that those controls are adequately met.
Should you start with a Class B certification? Maybe. It's a good place to be if you already have an existing client list with the government, and those agencies know that they're going to want you to achieve a Class B certification. You can talk with your agency partners about their requirements under the FedRAMP 20x framework, and they can let you know what level they need you to achieve.
In some cases, if you previously had a FedRAMP Moderate authorization, you might be able to use a Class B certification, even though Class C is more likely closer to what you already have.
See, a lot of CSPs needed to get a Moderate authorization because 99% of their operations would have been fine under Low Impact, but they had just enough outside of those boundaries that they passed the threshold and required Moderate instead.
With the class system, you can now land at a Class B certification with a few additional compensating controls that provide higher-tier assurance for those few extra details, instead of needing to go the entire step up to Class C.
When to Start with Class C Certification
The FedRAMP Class C certification is very likely where a lot of CSPs will end up, though it's also just as likely that many who end up there would have been better off at Class B with some compensating controls.
Class C has even higher standards, even more investment required, and also has more stringent requirements for verification, validation, agency assurance, and particularly automation.
Since Class C has a lot of security controls, and FedRAMP 20x is focused heavily on automation, Class C is where that automation becomes apparent. Machine-readable documentation and proof, machine-verifiable configurations, and automation will saturate every part of a Class C certification. If you aren't prepared to invest in this automation, you may want to look elsewhere.
"FedRAMP Class C Certifications are Adequate for use in most Low or Moderate impact agency information systems and some High impact agency information systems with appropriate compensating controls."
When should you start with a Class C certification?
If the information you will be handling is sufficiently controlled, such as CUI or financial records, Class C is likely the ideal. If you already have agency customers and you know they're going to want Class C, then you'll need Class C.
If you don't have existing agency customers, you should probably not start with Class C. FedRAMP even warns against this:
"Be careful starting with FedRAMP Class C or Class D Certification!
Cloud service providers generally should not go straight to FedRAMP Class C or Class D Certification unless they have an existing contract with a government agency that requires this level of commitment. These Certification Classes are intended for providers with an active customer base who have already invested in a federal compliance program."
Most of the time, then, you probably don't want to start with a Class C. You can start with Class B, and if necessary, either work on compensating controls or build up to a Class C later on when it makes sense to do so.
Overall, if you're new to FedRAMP, a Class A certification is a great place to start. If you're more experienced, either with FedRAMP or with another security framework like CMMC or ISO 27001, you can probably jump into a Class B with ease. There's relatively little reason to start with Class C unless you already know you need it from existing or potential contracts, and Class D is still forthcoming.
Remember, FedRAMP 20x is designed with mobility in mind, and with more flexibility for each certification class. You aren't locked in, and it's easier than ever to shift according to the needs of your agency customers. Aim for the minimum viable class, as that's where you're going to find the most cost-efficient certification.
Either way, we're here to help. We're keeping on top of news and changes that come with FedRAMP 20x, and we're answering your questions right here on our blog. If you have any questions, you can check if we've covered the topic, or drop us a line directly.
We also offer the Ignyte Assurance Platform for anyone in or looking to break into the FedRAMP ecosystem. As a framework-agnostic assurance platform, we've designed it to help you achieve any security status you want to seek. From tracking your compliance status, to following the specific tasks you need to complete, to aggregating all of the machine-readable proof and documentation in one place, the Ignyte Assurance Platform is your expert tool to achieve any FedRAMP Class certification.
To see how the Platform can work for you, reach out to schedule a customized demo for you today.
Dan Page is a seasoned Cybersecurity and Risk Management Executive known for advancing security programs aligned with complex regulatory frameworks and critical business objectives. With over 12 years in information security, his expertise began in the U.S. Army Signal Corps, where he led global communications and secured classified networks supporting Special Operations missions. Post-military, he specializes in security architecture for CUI, ITAR data, and federal cloud workloads. Currently, as Senior Cybersecurity Manager at Ignyte Assurance Platform, Dan guides organizations through compliance with CMMC, FedRAMP, ISO 27001, PCI, and NIST standards. A CISSP, CRISC, CISM, PMP, and ITIL-certified professional, he is also a cybersecurity lecturer and community volunteer advocating workforce development.