The SOC 2 to FedRAMP On-Ramp for ISVs
By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.
Note on terms: The Consolidated Rules retired “Authorized” as the status term: the status a cloud service holds is now FedRAMP Certified. Where this post says “authorization” generically, read “certification”.
The FedRAMP 20x Class A pipeline opened on August 3, 2026, and Class B and C followed on August 31. With the pipelines open, the software companies best positioned to move are the ones that already run a mature security program — which, for most ISVs, means a SOC 2 Type II report. That report is real, and it is worth a great deal. The mistake is treating it as a finished federal credential rather than the foundation of one.
This piece is the practical path: what your SOC 2 carries over, what it doesn’t, what a first-time federal seller is actually scored on, and the one artifact that turns all of it into motion before you submit. For full Class A submission mechanics and the new FedRAMP 20x taxonomy, see the FedRAMP 20x Class A pipeline guide.
What your SOC 2 carries over — and what it doesn’t
A SOC 2 Type II report is an independent examination: a CPA firm with no stake in the outcome tested your controls over a period and issued a result a third party can read. That independence is exactly what federal buyers look for — it is the difference between “we say we’re secure” and “someone who isn’t us verified it.”
What carries over is the operational substance: a functioning control environment, evidence-collection habits, and an examined baseline you can point to. A company with a clean SOC 2 Type II has already done much of the hard organizational work.
What does not carry over automatically is the standard. SOC 2 attests to controls against the AICPA Trust Services Criteria; a FedRAMP authorization attests to a federal baseline, verified by the federal process. The two overlap on many control families, but they are not interchangeable, and a federal evaluator is checking for the federal one.
So the honest map reads: SOC 2 gets you to the on-ramp in good standing; it does not merge you onto the highway. The ISVs that move through diligence fastest are the ones who say exactly that — here is what’s independently verified today, here is the federal delta, here is the plan to close it — rather than waving a SOC 2 as though it were an authorization it isn’t.
What a first-time federal seller is scored on
“Are we ready?” is not a feeling; for a federal seller it is a measurable position. GovExpress produces a 100-point Federal Readiness Score across 12 categories a federal buyer weighs. The six that most often decide a SOC 2 holder’s first federal year:
| Category | What it captures |
|---|---|
| Registration & Identity | Are you registered, current, and unambiguous in the government’s own systems? |
| Compliance Posture | Publicly observable FedRAMP, CMMC, and SOC 2 signals, verified and self-reported kept distinct. |
| Market Fit & TAM | How your offering maps to what agencies actually buy. |
| Competitive Position | How you sit among the vendors already winning your market. |
| Financial Readiness | Public signals of capacity to take on federal work. |
| Past Performance | The public federal track record a first-time seller by definition starts thin on. |
The methodology page lists all 12 and the five tiers the score reads as, from Not Federal Ready to Federal Established. The score on any vendor is computed from public federal data; your own full report adds your intake answers, shown as self-reported. That matters for a SOC 2 holder specifically: you typically bank real points on compliance posture while scoring thin on the federal-specific categories — past performance, registration, market fit — that a commercial security program never had reason to build. Seeing which is which, before an evaluator does, is the whole point.
(The weights behind each category are proprietary and not published here; what a seller needs is the shape of the picture — where you’re strong, where you’re thin — not the internal arithmetic.)
The 90-day plan is what turns a score into motion
A number on its own changes nothing. The artifact that does is a 90-day action plan: the sequence of specific moves that lift the categories you’re thin on: which registrations to complete, which federal-specific gaps to close, which verification steps convert a self-attested claim into an independently backed one — in the order that moves your position fastest before you submit.
For an ISV with a strong SOC 2 and a short federal runway, this is the difference between spending the next quarter guessing and spending it executing a sequence built for your own submission date.
If your path also touches Department of War work
This piece covers the civilian FedRAMP on-ramp. If your federal path also touches Department of War (DoW) work, a separate set of obligations applies — CMMC and DFARS 252.204-7012 — and those distinctions are their own load-bearing subject, covered in the companion CMMC piece in this series. The one thing to carry now: CMMC Phase I remains in force and Phase II is suspended, not cancelled — planning as though it’s gone is a mistake.
Start from where you actually stand
You have already done the expensive part: a real, independently examined security program. The open FedRAMP 20x pipelines reward the companies that build on it honestly — that know their score, know their verified-vs-self-attested posture, and hold a 90-day plan — over the ones that arrive with a SOC 2 and a hope.
See your federal readiness the way a contracting officer would — then work the 90-day plan.
Get your Federal Readiness Score to see exactly where your SOC 2 carries weight and where the federal-specific gaps are.
Related reading
Frequently Asked Questions
Does a SOC 2 Type II count toward a FedRAMP authorization?
Partly. The operational substance carries over — a functioning control environment, evidence-collection habits, and an independently examined baseline. The standard does not: SOC 2 attests to controls against the AICPA Trust Services Criteria, while a FedRAMP authorization attests to a federal baseline verified by the federal process. The two overlap on many control families but are not interchangeable, and a federal evaluator is checking for the federal one.
Is a SOC 2 enough to sell software to federal buyers?
It is not a substitute for an authorization. SOC 2 gets you to the on-ramp in good standing; it does not merge you onto the highway. The stronger position is to say plainly what is independently verified today, what the federal delta is, and what the plan is to close it — rather than presenting a SOC 2 as an authorization it isn't.
Where do SOC 2 holders usually score well, and where are they thin?
They typically bank real points on compliance posture, because an independent examination is exactly the kind of evidence that category rewards. They usually score thin on the federal-specific categories a commercial security program never had reason to build — past performance, registration and identity, and federal market fit. Seeing which is which before an evaluator does is the point of scoring yourself early.
The CMMC brief
What the Phase 2 suspension changed and what it did not — the obligations that still bind, the assessment path a contract puts you on, the scoping decision that drives the cost, and the sequence that fits inside a pipeline. Sourced from the primary record.