🔒 Closed beta: four products, running in production at Novaprospect · 📉 Corrections record: AI mistakes, counted by class and fed back into the next run · 📢 New post: Class B or Class C: The Rules Are the Same, the Clock Isn't · 📝 Also fresh: 1.83.7 Was the Answer to the Last Question: LiteLLM CVE-2026-59822 and Patching to a Minimum · 🚦 Beacon — the FedRAMP 20x KSI emitter — see what it emits ✨ · 🆕 20x Hub: program reference, kept current · 🧪 KSI Quick Check: KSI Quick Check — paste, run, get the verdict
← Blog
FedRAMPConMonCompliance

Class B or Class C: The Rules Are the Same, the Clock Isn't

In July we wrote up the transition calendar on the morning Marketplace listings opened, and the last rungs on it were still projections. They aren't anymore. FedRAMP's own end-of-July update named the dates plainly: the Class A pipeline opened Monday, August 3, and the pipelines for Class B and Class C both opened Monday, August 31, 2026.

The same update says what the classes replace. Class B is "an updated version of what stakeholders may have previously referred to as the FedRAMP Low impact level." Class C "is a mid-level baseline for certifications and replaces the FedRAMP Moderate impact level." The 20x program page now badges Class A, Class B, and Class C "Available now," and states that the full rules for all of them are finalized.

Which leaves a real decision in front of anyone who runs a small service and would like a federal customer: which one do you go for?

The intuitive answer turns out to be wrong

The intuitive answer is that Class C is Class B with more of everything — a wider control set on a longer package — so a small provider picks B, does less, and moves up when an agency asks for it.

That is not what the Consolidated Rules for 2026 say. The Class B ruleset reference and the Class C ruleset reference list the same fifteen rulesets, with the same subset and rule counts in every row. Nothing is added at C and nothing is dropped at B.

Pull the individual rulesets and compare them rule by rule and five of the fifteen come back identical, down to the wording: Minimum Assessment Scope, Marketplace Listing, Secure Configuration Guide, Significant Change Notification, and Addressing FedRAMP Communication. How narrowly you draw your boundary is not a function of your class. Neither is what you have to tell an agency when something changes.

The step that is a jump in kind sits below both of them. Class A's ruleset reference lists three rulesets — Certification Package Overview, FedRAMP Certification, and Marketplace Listing. Going from three to fifteen is the cliff. Going from fifteen to fifteen is not.

What actually separates B from C

The ten rulesets that do differ mostly differ in one dimension: how often you have to do the thing.

Obligation Class B Class C
Maintain the Certification Package so it stays current at least monthly at least every 2 weeks
Vulnerability detection on resources likely to drift at least monthly at least every 14 days
Vulnerability detection on resources not likely to drift at least every 6 months at least monthly
Verify and validate the status of machine-based resources at least every 7 days at least every 3 days
Evaluate a detected vulnerability within 7 days within 5 days
Publish vulnerability activity as JSON for automated retrieval at least monthly at least every 14 days
Initial Incident Report to affected parties within 6 hours within 1 hour
Updates during incident response within 1 business day within 6 hours
Final Incident Report within 3 business days within 6 hours
Automated methods validating each Key Security Indicator SHOULD, at least 1 MUST, at least 2
Historical KSI metrics at application SHOULD supply MUST supply, covering at least the past 6 months, for all KSIs
Synchronous Quarterly Review with agencies SHOULD host MUST host
Cryptographic modules with active CMVP validations MAY use SHOULD use

Remediation deadlines move the same way. Under Vulnerability Detection and Response, a likely-exploitable internet-reachable vulnerability rated PAIN-5 carries 4 days at Class B and 2 days at Class C; at PAIN-3 the same category is 32 days and 16 days. A couple of cells don't move at all: in the not-likely-exploitable column, PAIN-4 stays at 64 days and PAIN-2 stays at 192 days in both classes.

Key Security Indicators are the one place where the set differs rather than the cadence. Both classes list all 46 indicators. Class B marks 5 of them optional — Enforcing Intended State (KSI-CNA-EIS), Authorizing Log Access (KSI-MLA-ALA), Preventing Residual Risk (KSI-SVC-PRR), Removing Unwanted Data (KSI-SVC-RUD), and Validating Communications (KSI-SVC-VCM). Class C marks none of them optional.

So the honest framing of the choice is not "how much security do I have to build." It is closer to: can my team sustain a two-week package cycle and a one-hour incident clock, indefinitely? Class C is Class B for an operation that already runs faster.

Neither one needs an agency sponsor

Worth stating plainly, because it is the question that follows immediately. In the Consolidated Rules, the 20x-specific provider responsibilities are all scoped Path: Program; the FedRAMP Certification ruleset draws its contrast between "a FedRAMP Rev5 Agency Certification and a FedRAMP 20x Program Certification." The Agency path is a Rev5 construct. FedRAMP's own retrospective on the Phase 1 pilot puts it as a lesson learned: "Program authorization without an agency sponsor opened the door to offerings such as GRC tools — the largest submission category."

Class A is the one with a condition attached, and it is a clock rather than a sponsor: it accepts a completed SOC 2 Type II, a FedRAMP Readiness Assessment Report, or a GovRAMP report from within the past 12 months as your way in — and once a federal customer is actually using the service, you have 12 months to begin transitioning to Class B or higher. Class A is a doorway, not a room.

What "current" turns out to mean

"Evidence must be current" is the phrase everyone repeats about 20x, and it's easy to nod at without pricing. The rules price it.

The sharpest number is in the FedRAMP Certification ruleset, and it applies to every class: providers "MUST supply a fresh initial FedRAMP Certification Package that shows the current status of the cloud service offering as verified and validated by the provider within the previous 7 days." The independent assessment behind it has to have been completed within the previous 3 months. There is no version of that you satisfy by starting in the quarter you apply.

The Security Decision Record makes the point again from the other direction. Alongside the per-rule explanation, verification, validation, and independent review, a Class B provider must include historical metrics for each applicable Key Security Indicator: a summary over the past 30 days, and a summary up to the past year where available. Class C adds "all daily metric data up to the past year (where available)." A daily metric series for the past year is not an artifact. It is a byproduct of having run the thing for a year and kept the output.

And a detail that I think says more about the program's intent than any of the headline language: under Certification Data Sharing, providers must maintain a status service showing current and historical availability over at least the past 30 days, in human-readable and machine-readable form — and that service "MUST be available even if the primary cloud service offering is unavailable." The evidence has to survive the incident it is evidence about.

Where this lands for what we build

We've been building against this shape for a while, which is less foresight than it sounds — it's what happens when the operational record is the thing you'd have to hand over anyway.

NAICOM is the orchestration layer we run our own engineering on, and its useful property here is that the record is a side effect rather than a deliverable. Every dispatch writes a row with its issue key, role, verdict, and reason. Every session is tracked open and closed against a log file on disk. Every correction anyone makes to an agent's claim is recorded as a class alongside what was claimed and what was actually true, queryable by week. None of that was built to satisfy SDR-CSX-KMT, but a year of daily rows is exactly the shape of thing that rule asks for, and the reason it exists is that the work produced it, not that an assessment window was approaching.

Citadel sits closer to the KSI side. It runs query packs against a fleet and reports posture continuously rather than on request — which is the same motion as "at least 1 automated method for each Key Security Indicator" at Class B and "at least 2" at Class C. A pack that answers is disk encryption on across every host, right now is a measure demonstrating an indicator, and its history is the metric series. The awkward part of the C requirement isn't writing the query; it's having been running it for six months before anyone asked.

The question worth carrying

If the difference between Class B and Class C is mostly cadence, then the question to ask before you pick isn't which set of controls you can implement. It's which deadlines you can still meet in a bad week — the one where an incident is still open and the package is due anyway.

That's a harder question than a control matrix, and it's the one the rules are actually asking.

Reference