RFC-0022: FedRAMP's proposed fast path for services with SOC 2 or other outside assessments

In a February 2026 video, FedRAMP explained RFC-0022, a proposed temporary 20x path for cloud services that already passed an outside security assessment such as SOC 2. The 2026 Consolidated Rules now let 20x Class A applicants rely on SOC 2 Type II, GovRAMP, or Rev5 results from the past 12 months.

By FedXchange · February 5, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On February 5, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a short video, "What is the Intent of RFC-0022: Leveraging External Frameworks." It explains RFC-0022, Leveraging External Frameworks, a request for comment (RFC). FedRAMP's list of RFCs shows its comment period closed on February 26, 2026.

The video came out before the FedRAMP Consolidated Rules for 2026 (CR26). At the time, FedRAMP used the terms "FedRAMP authorization" and "FedRAMP Validated." Under CR26, FedRAMP calls its approval a "FedRAMP Certification," and a service that has one is "FedRAMP Certified." This post uses the current terms except when it describes what FedRAMP said then.

In short:

What FedRAMP said. A FedRAMP speaker said RFC-0022 was a brand new type of program authorization. A provider that had already met an outside security framework, such as SOC 2 or HITRUST, could use it to enter FedRAMP 20x at "validated level one."
Who it affects. Cloud service providers with an existing commercial security assessment, and agencies and providers that want to test or pilot those services before investing in a full FedRAMP path.
What it did not cover. Another speaker in the video said it does not apply to Rev5.
What happened next. Under CR26, a provider seeking a 20x Class A Certification must have completed SOC 2 Type II, GovRAMP, or FedRAMP Rev5 (including FedRAMP Ready) within the past 12 months. A fresh FedRAMP independent assessment is optional for Class A.

The path RFC-0022 proposed for services with an outside assessment

Source: RFC-0022 on fedramp.gov. This is what the RFC proposed in early 2026, not a current rule.

Read the steps as text

Outside assessment. The provider holds an accepted assessment, such as SOC 2 Type II, ISO/IEC 27001, HITRUST, GovRAMP, CMMC Level 2, or FedRAMP Ready.
Preparation listing. The provider lists its service in the FedRAMP Marketplace in the Preparation state.
Map to indicators. The provider maps its assessment to 13 Key Security Indicators, in machine-readable and human-readable formats.
Validated Level 1. The service is FedRAMP Validated Level 1, without a required assessment by a FedRAMP recognized assessor.
Agency ATO. An agency grants an authorization to operate (ATO) and notifies FedRAMP.
Full validation. The provider must obtain a FedRAMP 20x Validation within 12 months of the agency ATO.

What did FedRAMP say RFC-0022 was for?

In the video, a FedRAMP speaker said RFC-0022 "is about leveraging external security frameworks," and called it "a brand new type of program authorization that hasn't existed before." The speaker said it would come in through 20x at validated level one, and that "This is another way to come into the market."

The speaker spoke to providers still deciding between Rev5 and 20x. The speaker asked whether they had a SOC 2 (System and Organization Controls 2) report or HITRUST, or had otherwise already met an outside security framework's requirements commercially. A provider with those materials could start its FedRAMP work once the proposal was final and the path formally open.

Another speaker then said the path does not apply to Rev5. A speaker agreed that it would be a starting point for FedRAMP 20x.

The video's description calls it "a temporary high speed path" so that "federal agencies and providers can test and pilot these services prior to investing in a full FedRAMP authorization path."

What did RFC-0022 propose?

RFC-0022 proposed a status called "FedRAMP Validated Level 1." A provider would meet only a small part of the 20x Low requirements, without a required assessment by a FedRAMP recognized assessor. Rule MKT-LEF-ASF listed the accepted frameworks: SOC 2 Type II, ISO/IEC 27001, HITRUST e1, i1, and r2, StateRAMP (now GovRAMP) Provisionally Authorized or Authorized, CMMC (Cybersecurity Maturity Model Certification) Level 2, and FedRAMP Ready.

The RFC also set limits:

The status would last up to 1 year from the first agency reuse.
It does not establish "reciprocity" with any outside framework.
Agencies should limit reuse to pilot or test uses, or uses with negligible or extremely low risk.
Under a 3-strike rule, a first failure would bring a public notice and a 3-month grace period, a second would bring revocation for at least 3 months, and a third would bring suspension from the Marketplace for at least 12 months.

What do the 2026 Consolidated Rules say now?

CR26 does not use the name "Validated Level 1." Its FedRAMP Certification ruleset has a 20x Class A. FedRAMP's definitions say assurance increases "from minimal assurance at Class A to significant assurance at Class D." Rule FRC-CLA-ASF says a provider seeking Class A must have completed a certification or equivalent process within the past 12 months from one of these frameworks:

FedRAMP Rev5 (including FedRAMP Ready) at any historical impact level;
SOC 2 Type II;
GovRAMP at any impact level.

Rule FRC-CLA-IVV says a Class A provider may have its package independently verified and validated by a FedRAMP Recognized assessor. Rule FRC-APP-FIA makes a fresh independent assessment optional for Class A and required for Classes B, C, and D. ISO/IEC 27001, HITRUST, and CMMC are not on the Class A list.

FedRAMP's Important Dates page says FedRAMP began accepting 20x Class A applications on August 3, 2026.

What should cloud providers and agencies do?

A provider with a SOC 2 Type II or GovRAMP result from the past 12 months should read the Class A rules in CR26. A provider whose only outside assessment is ISO/IEC 27001, HITRUST, or CMMC should know that CR26 does not list those for Class A.

Agency staff should check a service's class before they reuse it, because Class A gives the least assurance of the four classes.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.