FedRAMP's September 20x update: two Class A providers on month-long packages, trust centers, and starting with the full rule set

Two small providers said a FedRAMP 20x Class A package took them about a month. Their advice: get a trust center and a Marketplace listing first, keep a clean SOC 2 Type II report, and work from the full machine-readable rule set, not the Class A rules alone.

By FedXchange · November 7, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its monthly 20x Community Update on September 9, 2026, and posted the video on September 15. FedRAMP 20x is the program's newer certification path, built on short rules and machine-readable evidence. Class A is its entry class. This meeting was a panel. Two cloud service providers that had earned a 20x Class A FedRAMP Certification described how they did it: Files.com, a managed file transfer company with about 60 to 70 staff, and Bland AI, a voice artificial intelligence (AI) platform with fewer than 100 staff.

In short. Both providers built a Class A package in about a month. Their main lessons for other providers:

Do the slow tasks first. A provider needs a FedRAMP-compatible trust center and a FedRAMP Marketplace listing before it submits. One provider said the listing took a couple of weeks.
Start from a clean System and Organization Controls (SOC) 2 Type II report. Class A builds on it.
Read the full rule set, in its machine-readable form, not only the Class A rules.
Plan the engineering work early. Meeting the technical rules was the hardest part for one provider.

For agency staff, the meeting shows what a Class A certification is built on: an existing SOC 2 Type II report mapped to FedRAMP's rules, with a commitment to raise assurance later.

What two providers did before submitting a 20x Class A package

Sources: the video, September 9, 2026; FedRAMP rules FRC-CLA-ASF, CDS-CSO-UTC, MKT-CSO-PML, AFC-CSO-INB, AFC-CSO-CRA, FRC-CSO-JSN, and CDS-CSO-PUB.

Read the steps as text

Read the full rule set. Start from the machine-readable rules and JavaScript Object Notation (JSON) schemas for every class, not only Class A, because some reporting rules differ.
Confirm the SOC 2 Type II report. Class A needs a SOC 2 Type II, GovRAMP, or FedRAMP Rev5 assessment completed within the past 12 months.
Get a trust center. Class A packages must be stored and shared in a FedRAMP-compatible trust center. One provider bought one in about a week.
Request a Marketplace listing. Every provider needs an Initial Implementation Phase listing before it can apply. One provider said this took a couple of weeks.
Set up the security inbox. FedRAMP sends emergency and test messages with deadlines. One provider sends them to its on-call paging tool.
Publish public JSON. Public JSON must be valid against FedRAMP's schemas, and should be served from a web server with cross-origin resource sharing (CORS) turned on.
Review as an assessor would. One provider had its AI assistant read the package as an assessor, which found unclear and undocumented items.

How long does a Class A package take?

About a month, for these two providers. FedRAMP published the Consolidated Rules for 2026 (CR26) on June 25, 2026, and providers could adopt them from July 4. Files.com's security chief said the company started on July 6 and set itself a target of August 3, the day Class A intake opened. It submitted on August 7, 32 days after starting, and received its certification letter on August 26. Bland AI said its package took a little over a month, and that it submitted as soon as FedRAMP's intake opened.

Each provider had one person do most of the work, with help from engineers. Files.com's security chief said he used an AI assistant throughout, and that its bill came to about $9,000. Bland AI said its main cost was staff time: four people, including two engineers. It said outside costs, such as an assessor and a governance, risk, and compliance (GRC) platform, were small next to that. Files.com named a three-year GRC platform contract and a new assessor as real costs.

What slowed them down:

The Marketplace listing. Files.com missed its target date because it had not yet asked for its listing. FedRAMP's Marketplace Listing rules say every provider must have an Initial Implementation Phase listing before it can apply, and rule MKT-CSO-PML says to request it through FedRAMP's listing request form, not by email. The security chief also said the link in FedRAMP's listing email returned an error for two days, so he found the listing by searching the Marketplace for the company name.
Interpretation. Bland AI said the rules are clear but leave room for judgment, and there is no knowledge base of past answers. It had prepared using a GRC vendor's view of the earlier 20x pilot, and had to redo work when the CR26 rules differed.
Reading only the Class A rules. Files.com said some reporting rules changed once it read the whole rule set. Its advice was to start with the entire rule set.

What do we need in place before we start?

Files.com's security chief listed several things to have in place. Four of them:

A clean SOC 2 Type II report. Rule FRC-CLA-ASF says a Class A provider must have completed a SOC 2 Type II, GovRAMP, or FedRAMP Rev5 assessment within the past 12 months. Rev5 is FedRAMP's older path, based on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog. Files.com called its SOC 2 report "the foundation" and said a provider whose report has findings may want a new audit first.

A trust center. Rule CDS-CSO-UTC says providers must use a FedRAMP-compatible trust center to store and share certification data. Files.com sent a request for proposals to trust center vendors the day it started and had one running about a week later. Its security chief said in the video: "If you don't have a trust center, don't bother submitting." The two providers made different choices here. Bland AI keeps a separate FedRAMP trust center from its commercial one, so commercial customers do not see the full certification package. Files.com uses one open trust center for everyone.

A FedRAMP Security Inbox. The related Class A rules say providers must keep an email address for FedRAMP's messages (AFC-CSO-INB) and must complete the actions in emergency and emergency test messages within the time the message gives (AFC-CSO-CRA). Files.com routes that inbox to its on-call paging tool. FedRAMP sent it a test message the day before its certification.

Public JSON on a suitable web server. Rule CDS-CSO-PUB requires public information about the service in human-readable and JSON formats. Rule FRC-CSO-JSN says public JSON must be valid against FedRAMP's schemas, and should allow CORS and send standard headers. Files.com said it had to change its web server for this.

How much engineering work does Class A take?

It depends on the product. Bland AI built a separate government instance of its platform, and said that was the hardest part of the whole effort. Files.com added a "FedRAMP mode" setting to its existing product. An administrator turns it on, and the product enforces strong encryption and keeps data and transfers in the United States. The company built it on an existing setting for the Health Insurance Portability and Accountability Act (HIPAA), so six engineers finished it in about a day and a half. Files.com said it had looked at FedRAMP before under Rev5 and decided a separate cloud would cost about $1 million a year.

Key Security Indicators (KSIs) are the measured security outcomes 20x uses. Asked about optional KSI automation at Class A, Bland AI said it uses its GRC platform plus some internal checks. Files.com said its AI assistant found that the company already met about 27 KSIs beyond Class A.

Both providers said they would start with Class A again. Bland AI said it submitted for Class C the day before the meeting. Files.com said it was choosing a new assessor so it could apply for Class B before the end of the year.

What did FedRAMP say about Class A?

A FedRAMP leader said Class A follows Office of Management and Budget (OMB) memorandum M-24-15, which describes FedRAMP as a bridge between industry and the Federal Government. The leader said FedRAMP studied accepting outside security frameworks outright and decided against it. Instead, a low-risk certification can be based on a summary and mapping of that framework, plus a commitment to raise assurance over time.

The leader said FedRAMP kept the rules short on purpose, and called the process "not a concierge process" in the video. Some providers had submitted without reading all the rules. The leader said FedRAMP's goal when it announced FedRAMP 20x was a low-impact certification in less than a week and for less than $5,000 of effort, and that Class A is close to that.

Since the meeting: at its October 14 20x update, FedRAMP said it had certified five Class A services and no Class B or Class C service. FedRAMP's November 2, 2026 post says it granted the first Class C Certification under the 2026 rules on October 29, 2026.

What should agencies and providers do now?

Providers planning Class A: request the Marketplace listing and buy or set up a trust center before writing the package. Confirm that your SOC 2 Type II report is from the past 12 months.
Providers: work from the full rule set and its JSON schemas. You remain responsible for every claim in the package, even when a tool or advisor helped write it (rule FRC-CSO-MRA).
Providers: set up the FedRAMP Security Inbox so someone sees emergency messages at once.
Agency security staff: a Class A certification is a low-risk certification built on an outside framework. Read the provider's trust center materials and SOC 2 report to decide whether it fits your use.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.