SOC 2 Type II to FedRAMP Class A: Your 90-Day Onboarding Plan

You've invested months in your SOC 2 Type II audit. Your CPA firm delivered a clean report. Your sales team wants federal contracts. Now what?

FedRAMP 20x's Class A certification offers a structured onboarding path for cloud service providers with recent SOC 2 Type II reports. This isn't reciprocity, and it's not a shortcut. It's a way to build on work you've already done while meeting federal requirements that SOC 2 doesn't cover.

Here's how to execute the transition in 90 days.

What You Need Before Starting

Prerequisites:

• SOC 2 Type II report completed within the last 12 months
• Access to all evidence and artifacts used in your SOC 2 audit
• Security documentation covering the five Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy)
• Executive commitment to a two-year timeline (Class A gives you 24 months to move to Class B, C, or D)

Team composition:

• Internal security lead with FedRAMP experience or access to consulting support
• System owner who understands your cloud architecture end-to-end
• Technical writer capable of translating controls into FedRAMP documentation format
• Continuous monitoring engineer (you'll need this capability operational at certification)

Budget reality check: You're not starting from zero, but you're not getting a free pass either. Expect 400-600 hours of internal effort plus third-party assessment costs. Your SOC 2 Type II work covers roughly 60-70% of Class A's baseline, but the remaining 30-40% includes federal-specific requirements not in the AICPA's framework.

Step-by-Step Implementation

Week 1-2: Gap Analysis

Download the FedRAMP Class A baseline from fedramp.gov. Your first task is mapping every Class A control to your existing SOC 2 evidence.

Create a three-column spreadsheet:

• Column A: FedRAMP Class A control number and requirement
• Column B: Corresponding SOC 2 Trust Services Criterion (if one exists)
• Column C: Gap status (Covered / Partial / Missing)

Focus on these common gaps:

Incident response: SOC 2 requires an incident response plan. FedRAMP requires specific reporting timelines to the agency, evidence of tabletop exercises, and integration with US-CERT for certain incident types. If your SOC 2 plan doesn't mention federal notification requirements, mark it "Partial."

Continuous monitoring: SOC 2 Type II demonstrates controls over time, but FedRAMP Class A requires ongoing Continuous Monitoring (ConMon) with monthly reporting. You need automated scanning, vulnerability management metrics, and a defined remediation SLA structure.

FIPS 140 cryptography: SOC 2 accepts commercial-grade encryption. FedRAMP requires FIPS 140-validated cryptographic modules for data at rest and in transit. Check your encryption libraries and key management systems against the NIST FIPS 140-3 validated modules list.

Configuration management: Your SOC 2 audit likely covered change control. FedRAMP wants baseline configurations documented in SCAP format (Security Content Automation Protocol), automated compliance scanning, and deviation tracking.

Week 3-4: Document the System Security Plan

The System Security Plan (SSP) is your primary FedRAMP artifact. It's not a SOC 2 document, and you can't submit your audit report as a substitute.

Use the FedRAMP SSP template. It's a structured Word document with specific sections:

Section 9 (System Environment): Describe your cloud architecture using FedRAMP's authorization boundary concept. This differs from SOC 2's system description because you must explicitly identify what's in-scope versus out-of-scope for federal data processing.

Section 10 (System Interconnections): Document every API, data feed, and third-party integration. FedRAMP requires you to identify whether interconnected systems are also FedRAMP authorized. If you use a non-authorized service (monitoring tool, logging platform), you'll need to explain compensating controls.

Section 13 (Control Implementation): For each Class A control, write a three-part response:

1. What is implemented (reference your SOC 2 control if applicable)
2. How you implement it (specific tools, configurations, procedures)
3. Where the evidence lives (point to your artifacts)

Example for AC-2 (Account Management):

• What: "We enforce Role-Based Access Control with quarterly access reviews."
• How: "Okta manages all user accounts. Managers receive quarterly access reports via automated workflow. HR triggers deprovisioning within 24 hours of termination."
• Where: "See Artifact AC-2.1 (Okta configuration screenshots), AC-2.2 (Q3 2024 access review), AC-2.3 (deprovisioning procedure)."

Week 5-6: Build Your Continuous Monitoring Program

Class A requires ConMon operational before certification. Set up these capabilities:

Automated vulnerability scanning:

• Deploy Tenable, Qualys, or Rapid7 across all in-scope systems
• Configure weekly authenticated scans
• Set up automated ticketing for findings rated High or Critical
• Document your remediation SLA (30 days for High, 15 days for Critical is typical for Class A)

Log aggregation and monitoring:

• Centralize logs in Splunk, Datadog, or similar SIEM
• Configure alerts for failed login attempts, privilege escalation, and configuration changes
• Retain logs for 90 days minimum (Class A requirement)

Monthly reporting:

• Create a ConMon report template covering: new vulnerabilities discovered, remediation status, security incidents, configuration changes
• Schedule monthly delivery to your designated agency contact once you're authorized

Week 7-10: Compile Evidence and Artifacts

FedRAMP wants proof, not promises. Organize evidence into these categories:

Policies and procedures: Your SOC 2 audit included these, but FedRAMP wants federal-specific language. Update your incident response plan to reference agency notification. Add FIPS 140 requirements to your cryptography standard.

Technical evidence: Screenshots of security configurations, system architecture diagrams, network topology maps, data flow diagrams showing where federal data moves through your environment.

Operational evidence: Access review reports, vulnerability scan results, patch management logs, security training completion records, business continuity test results.

Name your files using FedRAMP's convention: [Control Number]-[Brief Description]-[Date].pdf

Example: AC-2-Quarterly-Access-Review-2024Q3.pdf

Week 11-12: Third-Party Assessment

Engage a FedRAMP-recognized Third Party Assessment Organization (3PAO). They'll validate your SSP, test your controls, and produce a Security Assessment Report (SAR).

The 3PAO will:

• Interview your security team
• Review your documentation
• Perform technical testing (penetration testing, configuration reviews, vulnerability validation)
• Identify any findings that must be remediated before authorization

Budget two weeks for assessment activities plus one week for findings remediation.

Validation: How to Verify It Works

Before submitting your authorization package, run these checks:

SSP completeness test: Every Class A control must have a written implementation statement and corresponding evidence. Use the FedRAMP SSP checklist to verify you haven't missed required sections.

ConMon operational test: Generate a month of ConMon data before assessment. Can you produce vulnerability reports, incident logs, and change records on demand? If not, your ConMon program isn't ready.

Evidence traceability test: Pick five controls at random. Can you locate the referenced evidence files in under two minutes? If your evidence isn't organized and accessible, the 3PAO assessment will take longer and cost more.

FIPS validation check: Run openssl version on your systems. Verify you're using FIPS-validated modules. Check the NIST Cryptographic Module Validation Program database to confirm your encryption libraries appear on the validated list.

Maintenance and Ongoing Tasks

Class A certification isn't a finish line. It's a 24-month on-ramp to higher certification classes.

Monthly:

• Generate and submit ConMon report to your agency partner
• Review vulnerability scan results and update remediation status
• Monitor for new significant changes that require FedRAMP modification requests

Quarterly:

• Conduct access reviews and update evidence
• Review and update SSP for any architecture or control changes
• Test incident response procedures

Annually:

• 3PAO performs annual assessment
• Update SSP to reflect any changes in your environment
• Renew your FedRAMP authorization

Before month 18: Start your Class B assessment. Class A gives you two years, but moving to Class B requires 6-12 months of preparation. Don't wait until month 23 to begin.

Your SOC 2 Type II report proves you can operate secure systems. FedRAMP Class A proves you can operate them in a federal context. The gap between those two statements is real, but it's bridgeable in 90 days if you treat this as a documentation and evidence exercise, not a complete security rebuild.