Class A: must the SOC 2 Type II boundary match the offering, and can it carve out subservice organizations?

[2bkolohe]

We are a small commercial SaaS provider preparing for a 20x Class A application through the Program path. Before we engage an auditor, we would like to confirm three points about FRC-CLA-ASF and FRC-CLA-EAM:

1. If our SOC 2 Type II (Security criteria) covers exactly the commercial service we would list as the cloud service offering, with the same system description and boundary, does that satisfy FRC-CLA-ASF? Or does FedRAMP expect a boundary built specifically for federal customers?
2. Our service relies on several third parties (telephony, speech, database hosting and an LLM provider) that we would treat as carved-out subservice organizations in the SOC 2. Is documenting them under MAS-CSO-TPR sufficient for Class A, given that none of them holds FedRAMP status?
3. Is a first SOC 2 Type II with a 3-month observation period acceptable for FRC-CLA-ASF, or does FedRAMP expect a longer period?

Thank you.

[pete-gov]

If our SOC 2 Type II (Security criteria) covers exactly the commercial service we would list as the cloud service offering, with the same system description and boundary, does that satisfy FRC-CLA-ASF? Or does FedRAMP expect a boundary built specifically for federal customers?

It doesn't have to be exactly the same boundary, but we would expect all of information resources that you list for the MAS-CSO-IIR (Identify Information Resources) to be covered in the SOC 2 Type II. It is likely that the SOC 2 Type II would actually cover resources that you don't include in the MAS for various reasons.

We don't expect a federal-specific boundary at all! The intent is for you to "run what you brung" with Class A.

Our service relies on several third parties (telephony, speech, database hosting and an LLM provider) that we would treat as carved-out subservice organizations in the SOC 2. Is documenting them under MAS-CSO-TPR sufficient for Class A, given that none of them holds FedRAMP status?

Yes, that's right. Ensure to document the information flows and risk, such as what type of federal customer data would flow into those services and how that might affect customers (as well as if they can be disabled/etc.). You also might have compensating controls or mitigating measures in place and should document that.

This will help agencies make informed risk decisions - in a situation you described, an agency might want to use the service for communication with the public and would happily accept the risk of third-party telephony because all of the people using the service are coming in through an insecure public phone. Another agency might want to use it for secure phone calls and would not accept the risk of an unknown third-party telephony service. That's all working as intended!

Is a first SOC 2 Type II with a 3-month observation period acceptable for FRC-CLA-ASF, or does FedRAMP expect a longer period?

This should be acceptable, just note it.

[2bkolohe]

Very cool -- thank you, Sir.