Q: Which external frameworks are accepted for Class A?
A: The CSP must have completed an eligible certification or equivalent process within the preceding 12 months:
- FedRAMP Rev. 5, including FedRAMP Ready, at any historical impact level
- SOC 2 Type II
- GovRAMP at any impact level
For a SOC 2 Type II submission, provide the complete report, any applicable bridge or gap letter, verified audit-engagement documentation, the estimated schedule for the next report, and supplemental compliance evidence where applicable.
Source: fedramp
