FedRAMP 20x Class C Is Not Moderate. Read the Fine Print Before You Aim.
FedRAMP has transitioned from Low, Moderate, and High impact labels to Certification Classes B, C, and D. But treating Certification Class C as simply “the new Moderate” can lead providers to overlook what the change means for their assessment path. The familiar impact-level mapping is a starting point; understanding the requirements of your certification class is what helps you aim at the right target.
Why the comparison makes sense
The instinct is understandable. Class C broadly aligns with the impact level formerly called Moderate, the same tier that has always been the center of gravity for FedRAMP and the most common target for providers entering the federal market. For providers familiar with Moderate requirements, Class C is a natural point of comparison. But that comparison alone does not determine the appropriate certification class.
A certification class represents a level of assurance. Under 20x, that shifts the focus from the sensitivity of the data alone to the assurance a service must demonstrate through ongoing assessment. The question is broader than “How sensitive is the data?” It also asks, “How much assurance must this service provide, given who relies on it and for what?”
Why the difference bites
Two providers can handle similar data and still belong in different classes, because the class follows the assurance the buyer needs and the outcomes you have to prove continuously, not a one-time categorization. Choose your class by nostalgia for the old Moderate and you can land in one of two expensive places.
Aim too high and you commit your team to proving a level of assurance your buyers never asked for, a heavier continuous validation burden that adds cost without winning work. Aim too low and you certify a service that agencies who need more assurance cannot actually use, which means re-scoping and re-doing work that does not carry over cleanly.
How to actually place your service
Start from the data, not the letter. Rate the real impact to confidentiality, integrity, and availability across everything your system handles; the highest rating sets the floor. Then layer in the questions the old model never made you ask directly: who are your federal buyers, what assurance will they expect, and can your engineering team sustain the continuous validation that class demands, not for an assessment week, but as a way of operating.
Most providers will still land at Class C. That is fine. The point is to land there because your service genuinely belongs there, not because C looked like the closest synonym for a word that no longer exists.
