Key takeaway: Under CR26, FedRAMP organizes certification into Classes A, B, C, and D. Class A (Pilot) is an on-ramp for providers that hold a SOC 2 Type II. FedRAMP describes the classes as loosely aligned with the legacy Low, Moderate, and High expectations, with no direct correlation, and Class D as adequate for most use cases regardless of security objective, excluding systems that process classified information. Rev5 Class D requires Agency Certification, and a 20x Class D pilot is planned for Phase 4. For budget ranges see FedRAMP certification cost. For OSCAL packages see FedRAMP OSCAL and NISTcompliance.ai.
Under Consolidated Rules 2026, FedRAMP organizes certification into Classes A, B, C, and D, and moves its vocabulary from FedRAMP Authorized to FedRAMP Certified. This page covers FedRAMP's description of each class, the certification paths, and how to choose, with the sources linked from the pages it points to.
FedRAMP impact levels (Low, Moderate, High) and DoD Impact Levels (IL2 through IL6) are separate schemes, and the classes are neither. FedRAMP describes the classes as loosely aligned with the Low, Moderate, and High baseline expectations in NIST SP 800-53B and states that there is not a direct correlation, so do not translate a legacy label into a class without checking the class description. Class D is adequate for most use cases regardless of security objective, excluding systems that process classified information.
The classes are not DoD Impact Levels; IL2 through IL6 remain a separate scheme. Under CR26 the program's vocabulary also moves from FedRAMP Authorized to FedRAMP Certified, and certification is either Program Certification, issued by FedRAMP, or Agency Certification.
This page is the class-selection guide: FedRAMP's description of each class and the certification paths. For program mechanics, see What is FedRAMP 20x and the 20x roadmap. For OSCAL packages, see FedRAMP OSCAL. See how NISTcompliance.ai tracks Class requirements in the platform.
The four classes run from a pilot on-ramp (Class A) to Class D, which FedRAMP describes as adequate for most use cases regardless of security objective. The security objectives of your customer agencies drive the class you need, not provider preference.
Scroll sideways to compare all four classes.
| Attribute | Class APilot On-Ramp | Class BLoosely aligned to Low | Class CLow and Moderate objectives | Quzara Cybertorch BaselineClass DMost use cases | Rev5 Agency Path |
|---|---|---|---|---|
| FedRAMP description | Adequate for most non-sensitive use cases. New under 20x. | Adequate for most Low security objectives, and some Moderate or High objectives | Adequate for most Low and Moderate security objectives, and some High objectives | Adequate for most use cases regardless of security objective, excluding systems that process classified information |
| Published requirements | SOC 2 Type II, plus the Class A set of 7 Key Security Indicators | CR26 rulesets (15 on the Rev5 path) and the CR26 Key Security Indicators | CR26 rulesets (15 on the Rev5 path) and the CR26 Key Security Indicators | 15 Rev5 rulesets in the CR26 reference |
| Certification Path | Program Certification only | 20x: Program Certification. Rev5: Agency Certification, with a limited Program Certification pipeline. | 20x: Program Certification. Rev5: Agency Certification, with a limited Program Certification pipeline. | Rev5: Agency Certification, no Program Certification route. 20x: Program Certification expected in 2027. |
| Available under 20x | Yes, pipeline open since August 3, 2026 | Yes, pipeline open since August 31, 2026 | Yes, pipeline open since August 31, 2026 | Not yet. A Phase 4 pilot is proposed (RFC-0033, estimated FY27 Q1 to Q2); Rev5 Class D remains available through Agency Certification. |
| Who It Fits | Existing commercial products with a SOC 2 Type II and a mature security program. FedRAMP says most providers entering the federal market should start here. | Customer agencies whose security objectives are mostly Low. Confirm the expectation with the agency. | Customer agencies whose objectives span Low and Moderate. FedRAMP advises against going straight to Class C without an existing contract that requires it. | The broadest use cases, excluding classified systems. FedRAMP advises against going straight to Class D without an existing contract that requires it. |
| VDR & VER (under NTC-0014 from Dec 7, 2026)Vulnerability Detection and Response; Vulnerability Evaluation and Reporting | These rulesets take effect on December 7, 2026 under NTC-0014, with a grace period to March 7, 2027 for providers that have not yet adopted them. See the requirements. |
|||
These are buyer routes on this page only. Quzara is not publishing separate Class A, B, C, and D pages.
Cloud services entering the federal market through an external framework path such as SOC 2 Type II, without a full FedRAMP assessment yet. An on-ramp, not a permanent destination.
Plan your move to Class B or higher: after a federal customer begins using the service you have 12 months to start. Start OSCAL-ready evidence habits via OSCAL for FedRAMP and NISTcompliance.ai. Advisory: FedRAMP advisory.
Providers whose customer agencies need assurance for mostly Low security objectives. Full certification rather than a pilot.
Choose your path (20x Program Certification or Rev5 Agency Certification), then budget package, assessment, and ConMon using FedRAMP certification cost. Build the SSP story with What is an SSP and OSCAL automation on NISTcompliance.ai.
Providers whose customer agencies need assurance for most Low and Moderate security objectives. Providers serving defense contractors that handle Controlled Unclassified Information should check DFARS 252.204-7012, which requires a cloud service provider to meet security requirements equivalent to the FedRAMP Moderate baseline.
Plan KSI and continuous monitoring early via the KSI hub and automate ConMon. Package labor dominates cost; use the cost guide and NISTcompliance.ai for OSCAL SSP and POA&M. Document inheritance cleanly in OSCAL if inheriting from a higher platform.
Providers whose customer agencies need assurance across the full range of security objectives, excluding systems that process classified information. Rev5 Class D requires Agency Certification with no Program Certification route today, and FedRAMP lists 20x Class D Program Certification as coming in 2027.
Plan architecture and operations to the most demanding objectives your customer agency sets, from day one. For inheritance and MDR/SOC operations on a Class D platform, see Quzara Cybertorch. For package automation use NISTcompliance.ai. Advisory: FedRAMP advisory.
The certification path varies by class and by type (20x or Rev5). Program Certification is issued by FedRAMP without an agency sponsor, and Agency Certification involves a federal agency. FedRAMP states that Program Certifications are limited to one type, 20x or Rev5.
Class A is available only through 20x Program Certification, with no agency sponsor required. It is not offered on the Rev5 path. The 20x Class A pipeline opened on August 3, 2026.
On the 20x path, Class B is available through Program Certification, and Agency Certification is unavailable. The 20x Class B and Class C pipeline opened on August 31, 2026. On the Rev5 path, Agency Certification is generally required. Two limited Program Certification pipelines for Class B and C, Lost Sponsor and Ready Conversion, opened on August 10, 2026 and close on June 11, 2027.
Class C has the same availability as Class B: 20x Program Certification, with the pipeline open since August 31, 2026, or Rev5 Agency Certification with the same limited Program pipelines. Confirm which path your customer agency will accept before you choose.
Under Rev5, Class D has no Program Certification path and requires Agency Certification. Under 20x, FedRAMP lists Class D Program Certification as coming in 2027.
Under Rev5 paths, Class B and C are available with the constraints above and Class D requires Agency Certification; Class A is not available under Rev5. Under 20x paths, Class A, B, and C are available through Program Certification. Class D is expected through Program Certification in 2027, with a pilot proposed for Phase 4 (RFC-0033, estimated FY27 Q1 to Q2, dates subject to change). Path choice affects timeline and cost drivers; see the cost guide for package and assessment ranges.
The choice between Class A, B, C, and D follows the security objectives of the customer agencies you serve, not provider preference. The steps below cover how to decide.
What security objectives do your customer agencies need? FedRAMP describes Class B as adequate for most Low objectives, Class C for most Low and Moderate objectives, and Class D for most use cases regardless of objective, excluding systems that process classified information.
Which federal agencies and missions will the system serve? Ask each agency which class it will accept. FedRAMP advises providers not to go straight to Class C or Class D unless they have an existing government contract that requires that commitment or an active customer base with a federal compliance program.
The receiving agency's own requirements determine the class it will accept. Confirm the agency's certification expectations during the procurement phase, not after.
For providers entering the federal market without an existing FedRAMP authorization, Class A is the entry point FedRAMP recommends for existing commercial products that already hold a SOC 2 Type II and run a mature security program. After a federal customer begins using the service, the provider has 12 months to start moving to Class B or higher. Use it as an on-ramp, not as a destination.
Building on a FedRAMP Certified platform can reduce what a provider has to implement and document itself, whatever its target class. A Class C service inheriting from a Class D platform can reference the controls the platform implements, as set out in the platform's responsibility matrix. Because the classes are not a one-for-one match to the legacy baselines, confirm the inheritance position with your assessor.
A cloud service that starts at Class B may need to migrate to Class C as its customer base expands into missions with higher security objectives. Plan the architecture and instrumentation for the eventual target class even if the initial certification is at a lower class. Re-engineering for a higher class after the fact is expensive.
Quzara Cybertorch operates at Class D on Azure Government. The operating position is structurally significant for customers at any class. The items below cover how the Class D position amplifies value for cloud providers building federal-market services.
Inheritance is most valuable when the platform's certification is at least as demanding as the inheriting service's target class. A Class C service inheriting from a Class D platform can reference the controls the platform already implements instead of building them, which reduces the surface area of its own package. The amount it can claim is set by the platform's responsibility matrix, so ask for the matrix and confirm the inheritance with your assessor.
Cybertorch's Class D status is verifiable on the FedRAMP Marketplace at Marketplace ID FR2214150164. The Marketplace listing is the authoritative source for provider class status, and procurement teams should always verify provider claims against the Marketplace listing during the RFI phase.
Cybertorch operates with 100 percent U.S.-citizen analysts, which matters to customers whose contracts or data-handling rules require U.S.-person access. Confirm your own contractual requirements with your contracting officer.
Cybertorch operates on Azure Government and is authorized for DoD IL-4. Microsoft GCC High native support extends the operating envelope to GCC High customers.
Cybertorch's responsibility matrix defines which controls a customer can inherit. They center on the Audit and Accountability, Incident Response, and Continuous Monitoring families. Inheriting them can reduce the need to build and operate a SIEM, log retention, and 24/7 incident response independently. Ask for the matrix to confirm the exact controls for your boundary.
NISTCompliance.AI produces audit-ready SSPs and OSCAL machine-readable output. For a customer inheriting from Cybertorch, the SSP records which controls are inherited, shared, or customer-owned, based on the platform's responsibility matrix.
Class D has no 20x certification yet, so Cybertorch operates on a Class D certification on the Rev5 path today. FedRAMP plans a 20x Class D pilot in Phase 4 and lists 20x Class D Program Certification as coming in 2027. Customers can reference Cybertorch's controls in their own 20x certifications at Class B or Class C in the meantime.
Existing Rev5 offerings move to the CR26 rules on the dates in the Rev5 deadlines, and NTC-0013 says the end date for existing Rev5 certifications has not been finalized and is likely no later than 2029. Quzara maps your current authorization to the class structure, to the CR26 dates that apply to you (Vulnerability Detection and Response and Vulnerability Evaluation and Reporting on December 7, 2026; CR26 mandatory on January 1, 2027), and to your inheritance posture from Quzara Cybertorch, which operates at Class D on Azure Government. NISTCompliance.AI handles the OSCAL package generation across all classes. Request a consultation to plan the transition.
