FedRAMP for SaaS Leaders

Before you can decide whether to pursue it, you need a precise mental model of what FedRAMP is, what problem it solved, and — critically — what it is not.

The origin story, in the shortest useful form

Three legal instruments stack up to create the thing you're evaluating:

• FISMA (2002, substantially amended 2014). The Federal Information Security Modernization Act requires every federal agency to run an information security program and to authorize every information system it uses. That authorization is called an ATO — Authority to Operate — and it is granted by an agency official, the Authorizing Official (AO), who is personally accountable for accepting the residual risk.
• OMB's "Cloud First" policy (December 2010). Federal CIO Vivek Kundra pushed agencies to adopt cloud by default. This immediately created a problem: FISMA required every agency to independently authorize every system, so twenty agencies buying the same SaaS product meant twenty independent, redundant, wildly inconsistent security assessments — each costing the vendor months and hundreds of thousands of dollars.
• The FedRAMP memo (December 2011), operational June 2012. OMB established FedRAMP to solve exactly that redundancy with the principle that still defines the program: "assess once, use many." A cloud service provider undergoes one standardized assessment; the resulting package is reusable by any agency that wants to grant its own ATO on top of it.
• The FedRAMP Authorization Act (December 2022), passed as part of the FY2023 NDAA, codified the program in statute rather than leaving it as policy. This matters more than it sounds: it gave FedRAMP a legal mandate for reciprocity — agencies are expected to reuse existing FedRAMP packages rather than demanding their own bespoke assessment — and it created the political cover for the aggressive modernization you're seeing in 2026.

The three actors and what each one wants

Agency authorization vs. the JAB — and what CR26 did to it

Historically there were two routes to the FedRAMP Marketplace:

• Agency ATO — a single sponsoring agency assesses and authorizes you; other agencies then reuse the package. Faster, but you must find a sponsoring agency, which is a business-development problem masquerading as a compliance problem.
• JAB P-ATO — the Joint Authorization Board (DoD, DHS, GSA) granted a Provisional ATO. Prestigious, government-wide, and a brutal queue: FedRAMP Connect admitted only a handful of CSPs per year.

The JAB has been retired. Under the modernized program, authorizations run through the FedRAMP PMO in coordination with agency sponsors, and the emphasis has moved decisively toward automated validation over board review. If you read older FedRAMP guidance that tells you to "apply to FedRAMP Connect," it is out of date.

The Marketplace and why "assess once, use many" is a real moat

The FedRAMP Marketplace is the public, searchable registry of cloud service offerings that have achieved a FedRAMP designation. It is where a contracting officer at the Department of Labor goes when someone says "we want to use a learning platform." Three practical consequences:

1. Presence is discovery. Being on the Marketplace means you appear in the set of options an agency considers. Absence means you frequently do not get considered at all, regardless of product quality.
2. Reuse compounds. The first agency is expensive to land. Agencies two through twenty inherit the package. Your marginal cost per federal customer collapses, which is precisely why the moat is real — a competitor without certification cannot match your sales cycle at any price.
3. Status is visible. The Marketplace distinguishes between designations — "In Process," "Ready," and full certification. A sales team can and will use a competitor's status against them, and vice versa.

What FedRAMP is not

✅ Knowledge Check

🃏 Flashcards

Consolidated Rules for 2026 took effect three weeks ago. Almost every FedRAMP article, consultant deck, and internal wiki page written before this summer is now describing a program that no longer exists.

What CR26 is

The Consolidated Rules for 2026 (CR26) replaced a decade-plus accumulation of memos, Requests for Comment, notices, and baseline documents with a single consolidated rulebook. It took effect July 4, 2026, with enforcement beginning January 1, 2027, and the ruleset is intended to hold through December 31, 2028 before the next consolidated set replaces it.

The framing that matters for you: CR26 changed the vocabulary, the document formats, and the operating model — not, for the most part, the underlying security requirements. A service authorized at Moderate today carries forward as Class C with the same controls and the same boundary. If you are starting from zero, this is good news: you are learning one clean rulebook instead of reverse-engineering a decade of accreted policy.

Change 1 — Impact levels became Certification Classes

The FIPS 199 labels of Low / Moderate / High are retired in favor of Certification Classes A through D.

Change 2 — "Authorized" became "Certified"

FedRAMP Authorization is now FedRAMP Certification. This is not cosmetic in one respect: it removes the ambiguity between the FedRAMP designation and the agency's ATO, which were both loosely called "authorization" and were constantly confused. Update your marketing copy, your trust center, your RFP boilerplate, and your sales enablement — using retired terminology in a federal proposal reads as "this vendor has not been paying attention."

Change 3 — Prose documents became machine-readable requirements

This is the deepest change and the one with the most engineering consequence.

• Requirements are now published as discrete, versioned, MUST / MUST NOT / SHOULD statements maintained in public repositories on GitHub, rather than as narrative PDFs. You can diff them. You can subscribe to changes. You can write tests against them.
• The System Security Plan (SSP) — historically a 300-plus-page Word document describing how each of hundreds of controls is implemented — has been retired in its prose form, replaced by machine-readable representations.
• The Plan of Action and Milestones (POA&M) — the spreadsheet of known deficiencies and remediation dates — is likewise replaced by structured formats.
• Authorization materials are submitted in JSON and Markdown. Related guidance (RFC-0024) requires machine-readable packages, including OSCAL, for FedRAMP providers by September 2026.

Change 4 — Broader and more automated continuous monitoring

CR26 widens ongoing obligations in four specific directions:

• New incident reporting triggers. More categories of event now require notification, on tighter clocks. Your incident response runbook needs a federal branch with its own severity mapping and reporting timeline — not a footnote in the existing one.
• Availability reporting. Uptime and service availability are now reportable, not just a contractual SLA matter. Your existing SLO tooling likely covers the measurement; what you need is the reporting pipeline and the definitions that match FedRAMP's, not yours.
• Configuration guides. You must publish secure configuration guidance for how agencies should deploy and configure your service — a customer-facing artifact that has to stay accurate as the product changes.
• Balance Improvement Releases are mandatory. Previously optional improvement cycles are now required. FedRAMP has also begun issuing responses to CISA Binding Operational Directives (for example, BOD 26-04 on prioritizing security updates based on risk) that flow through to providers. Translation: the compliance target moves on a schedule, and you must move with it. Staffing a program at "enough people to pass the audit" leaves you understaffed by design.

The timeline you need on a slide

✅ Knowledge Check

🃏 Flashcards

If Coursera pursues federal certification, this is almost certainly the path. It is faster, dramatically cheaper, and structurally biased toward exactly the kind of company Coursera is.

The core idea: outcomes, not paperwork

Traditional Rev5 asks: "Describe, in narrative prose, how you implement each of roughly 325 NIST SP 800-53 controls, and let an assessor sample your evidence." The output is a document. The document is stale the day it ships.

FedRAMP 20x asks a different question: "Demonstrate, through automated validation against your running infrastructure, that these security outcomes are true right now." The output is a continuously-verifiable claim.

The unit of that model is the Key Security Indicator (KSI).

Key Security Indicators

A KSI is a measurable security outcome that can be validated through automation. Each KSI maps to a set of underlying NIST SP 800-53 controls — the security rigor is not reduced, the expression of it is. Instead of writing prose about your access control policy, you demonstrate programmatically that MFA is enforced, that privileged access is time-bound, that keys rotate.

The published counts are 56 KSIs for Low and 61 for Moderate (Class B and Class C respectively). Treat those numbers as a version, not a constant — the indicator set is actively maintained in public repositories, and different sources snapshot different revisions. AWS's own deep-dive, for instance, walks through 63. Always validate against the live repository before planning a gap assessment.

KSIs are organized into capability clusters. The recurring themes:

The completeness bar

The Phase 2 pilot set an explicit standard that is the best available guide to what Phase 3 will expect:

The rollout

Why 20x favors Coursera specifically

The program's design assumptions read like a description of a modern SaaS platform team, and they cut against legacy vendors:

• Cloud-native is assumed, not accommodated. If you run containers on managed cloud infrastructure with everything defined as code, you are the reference architecture. If you run a virtualized data center with a change advisory board, you will struggle to hit 70% automation.
• Inheritance does heavy lifting. Building on an already-certified IaaS provider lets you inherit a large fraction of infrastructure-layer indicators rather than proving them yourself. This is the single biggest lever on both cost and timeline.
• Continuous validation replaces annual theater. Instead of a once-a-year evidence scramble, the same automation that produces your submission keeps producing it. The marginal cost of staying certified drops toward the cost of running the pipeline.
• Small scope wins. Because every KSI must be addressed, a narrow boundary is dramatically cheaper than a broad one. A scoped "Coursera for Government" service is a far better 20x candidate than "all of Coursera."

✅ Knowledge Check

🃏 Flashcards

Two dates govern the strategic timing of this decision, and they point in opposite directions. Understanding why creates a genuine, time-limited advantage.

The two dates

Why this creates a window rather than a deadline

Read the two dates together with the cost figures from Module 3 and something interesting appears. Normally, a compliance regime tightens over time: early participants get an easy standard, latecomers face a harder one. Here the opposite is happening. The expensive, slow path is the one being retired, and the cheap, fast path is the one opening up. For roughly the next four to six quarters, three conditions hold simultaneously:

1. 20x is open to all qualifying providers at Class B and Class C (since August 31, 2026), at roughly a fifth of the Rev5 cost.
2. Legacy competitors are distracted. Vendors holding Rev5 certifications are spending their compliance budget on conversion — moving an existing authorization into the new class structure before the 2028 sunset — not on new capability. That is defensive spend. Yours would be offensive spend.
3. The Marketplace is thin in your category. Federal learning platforms are not a crowded FedRAMP category. That thinness will not last if 20x makes entry cheap for everyone.

The Rev5 → CR26 conversion paths (context, not your path)

You would be a new entrant, so these do not apply to Coursera — but you will hear them referenced constantly and should recognize them:

• Ready Conversion pipeline (opened Aug 10, 2026) — for providers with an existing Rev5 designation moving into the new certification classes.
• Lost Sponsor pipeline (opened Aug 10, 2026) — for providers whose sponsoring agency relationship ended, a historically fatal event that stranded otherwise-compliant vendors. Its existence is a meaningful signal that FedRAMP is trying to reduce the brutality of sponsor dependency.

Format migration: JSON, Markdown, OSCAL

Whichever path a provider is on, the submission format is changing. Authorization materials must be submitted in JSON and Markdown, and RFC-0024 requires machine-readable packages including OSCAL by September 2026.

For a new entrant this is pure upside: you never build the legacy artifact. Design your evidence pipeline to emit OSCAL-shaped JSON from day one, and render any human-readable view from that source. Providers who spent a decade maintaining Word documents are the ones paying a migration tax; you would not be.

Evidence pipeline — the shape to build toward

  infrastructure-as-code  ──┐
  IdP / IAM configuration ──┤
  scanner + SBOM output   ──┼──▶  collector  ──▶  ksi-evidence.json  (OSCAL-aligned)
  log pipeline config     ──┤                            │
  CI/CD + change records  ──┘                            ├──▶ machine validation (CI gate)
                                                         └──▶ rendered Markdown (human review)

  Rule: the machine format is the source of truth.
        The human-readable document is a build artifact, never hand-maintained.

✅ Knowledge Check

🃏 Flashcards

This is the module that either saves Coursera a million dollars or tells you the million dollars is unavoidable. Everything turns on one question: what federal information crosses the boundary?

The rule, stated precisely

FedRAMP applies when a cloud service processes, stores, or transmits federal information on behalf of an agency. It is triggered by data, not by customer. An agency can be your customer without triggering FedRAMP; an agency can trigger FedRAMP with a single integration that never involves a purchase order change.

Two corollaries that people consistently get wrong:

• A federal customer alone does not trigger it. Agencies routinely buy commercial services under low-risk determinations where no agency information enters the service. This is the posture Coursera operates in today.
• The agency's Authorizing Official makes the call, not you. You can build a strong argument for a low-risk determination. You cannot make the determination. Different agencies — and different AOs within the same agency — reach different conclusions on identical facts. Plan for the strictest reading you are likely to encounter in a deal you actually want.

The five-rung ladder

Map any proposed federal engagement onto this ladder. Coursera's current posture is Rung 1. Every rung up is a product decision that carries a compliance consequence.

Where each Coursera product line lands

The questions to ask your GTM team before spending anything

1. Show me the pipeline. How many federal opportunities have we lost specifically to a FedRAMP requirement in the last eight quarters? Names, dollar values, and the actual language of the disqualification. Anecdote is not evidence here — "customers keep asking" is a very different fact from "we lost these four deals."
2. Was it FedRAMP or something else? Losses get attributed to FedRAMP that were really about price, incumbency, contract vehicle, or Section 508 accessibility. Read the debriefs.
3. What did the winner have? If the winner also lacked FedRAMP, it was never the binding constraint.
4. Is there a named agency willing to sponsor? Not "interested in Coursera" — willing to put an Authorizing Official's name on a sponsorship. This is the single highest-information question in the entire evaluation, and it is answerable in weeks.
5. What does the target integration actually require? Have a solutions architect map the top three federal opportunities onto the ladder. You may find the real requirement is Rung 2 and everyone assumed Rung 4.

✅ Knowledge Check

🃏 Flashcards

The compliance question is tractable. The business question is where this decision actually lives — and it is the one most engineering leaders under-prepare for.

Sizing the federal opportunity

Public data on federal learning spend is fragmentary, so build the estimate bottom-up and label the assumptions explicitly. Anchors worth using:

• The federal civilian workforce is roughly 2.1 million employees — before counting the uniformed military or the far larger contractor base.
• US training spend overall reached about $102.8 billion in 2025, up 4.9% year over year — useful for context on the commercial baseline, not a federal figure.
• GSA has actively solicited learning content providers to support federal workforce modernization, seeking pay-for-access content mapped to 54 competency areas with emphasis on data, technology, and financial management skills — exactly Coursera's catalog strength.
• Coursera already partners with 900+ organizations including federal agencies, and is on the GSA MAS.

The competitive landscape — and a correction worth having

This is where a widely-repeated assumption in ed-tech turns out to be wrong, and the correction favors Coursera.

Building the ROI case honestly

Three components, and most business cases only include the first:

1. Revenue unlocked. Deals you cannot bid today. Requires the pipeline evidence from Module 5 — real opportunities, real dollars, real disqualification language.
2. Deal size expansion on existing federal relationships. Often the larger number and almost always omitted. An agency at Rung 1 buying seats is a small contract. The same agency at Rung 4, with Coursera integrated into its talent system, is a materially larger and stickier one. Certification is what makes the expansion motion legal.
3. Defensive value. If Blackboard or a certified newcomer bundles a federal learning offering, what does Coursera lose in accounts it holds today? This is speculative but not zero, and it belongs in the case explicitly labeled as speculative.

Against that, the full cost — not just the audit:

✅ Knowledge Check

🃏 Flashcards

This is your module. Everything above is strategy; this is the work your teams would actually do, and the architectural decision that determines whether it is a quarter or two years.

Decision zero: the authorization boundary

Before any control work, one architectural choice dominates cost, timeline, and permanent operating burden: what is inside the boundary? Everything inside is assessed, monitored, and change-controlled forever. Everything outside is not.

The control domains, and what each demands

Identity and access management

• Phishing-resistant MFA for all privileged access, with no exceptions and no break-glass account that bypasses it. Break-glass exists, but it is monitored, alarmed, and time-bound.
• PIV/CAC support for federal end users where the agency requires it, alongside standard SAML/OIDC federation.
• No long-lived credentials. Short-lived, automatically-rotated credentials for all machine access. Static keys in CI are one of the most common findings.
• Just-in-time privileged access with approval and full session recording. Standing production admin is the finding auditors love most.
• Documented, evidenced access reviews on a defined cadence — and prompt deprovisioning that you can prove, with timestamps.

Cryptography — the one with a hard technical gate

• FIPS 140-3 validated cryptographic modules. This is not "we use strong encryption." It is: the specific module must appear on the NIST validated list. This has real implementation consequences — FIPS-mode TLS libraries, specific managed-service configurations, sometimes different runtime images.
• Encryption in transit everywhere, including service-to-service inside your own network. Internal plaintext traffic is a finding.
• Encryption at rest for all data stores, backups, and snapshots. Backups are the commonly-missed one.
• Managed key lifecycle — documented rotation, separation of duties, and access to keys that is itself logged and reviewed.

Logging, monitoring, and audit

• Comprehensive audit logging of authentication, authorization decisions, data access, configuration change, and privileged operations.
• Tamper resistance. Write-once or append-only storage with integrity verification. An engineer who can delete audit logs is a finding.
• Defined retention meeting federal requirements — typically longer than commercial defaults, with cost implications you should model up front.
• Time synchronization to an authoritative source, with the correlation story that depends on it.
• Alerting on security-relevant events, with documented response procedures and evidence they were followed.

Vulnerability and configuration management

• Authenticated scanning on a defined cadence — infrastructure, containers, web application, and database layers.
• Remediation SLAs by severity. The traditional expectation is roughly 30 days for high, 90 for moderate, 180 for low. Under CR26, FedRAMP's response to CISA BOD 26-04 pushes toward risk-based prioritization, so treat those numbers as a floor and track the current guidance.
• Hardened baselines (CIS or equivalent) with automated drift detection.
• An SBOM and dependency provenance for the software supply chain.
• Formal change control for anything touching the boundary — with a defined threshold for what constitutes a "significant change" requiring agency review before deployment.

Incident response

• A federal branch of your IR plan with its own severity mapping, notification obligations, and clocks — CR26 added triggers and tightened timelines.
• Tested annually with documented tabletop exercises. "We have a plan" is not evidence; "here is the exercise record and what we changed afterward" is.
• Defined RTO and RPO with tested restores. Untested backups are a finding, and the test evidence is what gets sampled.

Personnel and supply chain

• Background screening for personnel with access to the federal boundary — a real HR process change, and one with lead time.
• US-person requirements may apply depending on agency and data sensitivity. This is the constraint that most often collides with a distributed engineering org, and it is worth checking before you promise anything. It is a strong argument for a small, dedicated federal platform team rather than "everyone can operate it."
• Vendor and subprocessor inventory with a clear story for every third party in the boundary — including which upstream FedRAMP certifications you inherit from.

The order to do it in

Sequencing — highest KSI leverage first

  Q1  Identity          MFA universal, kill long-lived creds, JIT privileged access
      Boundary          Decide scoped GovCloud vs logical; write it down; freeze it
      Crypto audit      Map every cryptographic dependency to FIPS 140-3 validation

  Q2  Logging           Immutable audit pipeline, retention, alerting, time sync
      Config mgmt       Hardened baselines + automated drift detection
      Vuln mgmt         Authenticated scanning cadence + SLA tracking dashboard

  Q3  Evidence          Automated collector emitting OSCAL-aligned JSON in CI
      IR + recovery     Federal IR branch, tabletop, tested restore, RTO/RPO
      Supply chain      SBOM, subprocessor register, inheritance mapping

  Q4  Gap assessment    3PAO readiness review against live KSI set
      Submission        Package, validate, submit

  Identity and Logging gate the most KSIs. Do them first regardless of
  whether the FedRAMP decision is ultimately go or no-go.

✅ Knowledge Check

🃏 Flashcards

Numbers you can put in a budget request, with the ranges stated honestly and the assumptions visible.

Published cost bands

These are market ranges as of 2026. Treat them as planning figures, not quotes — actual 3PAO pricing varies substantially with boundary size, architecture, and how much remediation the assessor has to wait on.

Estimate your number

Adjust the inputs below. The model applies published base bands, then multiplies for boundary scope, engineering maturity, and tooling approach. It is a planning instrument, not a quote — but the shape of the sensitivity is the useful part.

The line items behind the number

✅ Knowledge Check

🃏 Flashcards

You are being asked to stand up a permanent capability, not run a project. The org design decisions here outlive the certification.

The three roles you must fill

GRC platform: what you are actually buying

Secureframe, Drata, Vanta, Paramify and peers all offer FedRAMP-oriented modules. Notably, Secureframe participated in the 20x Phase 2 Moderate pilot, which is a meaningful signal about which vendors have real depth in the new model versus a repackaged SOC 2 product.

What a GRC platform genuinely gives you:

• A control framework already mapped to KSIs and NIST 800-53, so you are not building the crosswalk yourself.
• Connectors that pull evidence automatically from AWS, your IdP, your scanners, your HR system, your ticketing.
• Package generation in the required machine-readable formats — increasingly the main reason to buy rather than build.
• Continuous monitoring workflow — the recurring cadence, the reporting, the reminders that keep you certified.
• Multi-framework reuse. The same evidence serves SOC 2, ISO 27001, and FedRAMP. If Coursera already runs one of these platforms for SOC 2, extending it is usually the right call.

Choosing a 3PAO

Five questions, in priority order:

1. How many 20x KSI-based assessments have you actually completed? Not Rev5 assessments — 20x. It is a young practice and depth varies enormously. Ask for the count and for references.
2. Who is on my team, specifically? Firms sell with principals and staff with juniors. Name the assessors and their experience.
3. How do you handle automated evidence? A 3PAO that wants screenshots will erase your automation advantage entirely.
4. What is your capacity and calendar? Phase 3 opened to everyone weeks ago. Good assessors are booking out. This is a real constraint on your timeline.
5. Fixed fee or time-and-materials? Fixed fee with a clearly defined scope protects you from a remediation cycle turning into an open-ended invoice.

Finding an agency sponsor

The genuinely hard part, and it is business development, not compliance:

• Start from existing relationships. Which agencies already buy Coursera through GSA MAS? Which have an active champion? A sponsor almost always emerges from a customer who already wants more of you, not from cold outreach.
• Find the mission need, then the sponsor. An agency sponsors because it wants your capability, not to do you a favor. Lead with the workforce-development outcome the agency is already accountable for.
• Talk to the CIO org, not only procurement. The Authorizing Official sits in the security organization. Procurement can want you and the AO can still decline.
• Understand what you are asking. Sponsorship costs the agency real staff time and puts an official's name on a risk acceptance. Reduce that friction: bring a complete package, a clean architecture, and inherited controls that make review easy.
• Note the safety net. The Lost Sponsor pipeline now exists, which materially reduces the historical catastrophic risk of a sponsor evaporating mid-process. That is worth knowing when you weigh the bet.

✅ Knowledge Check

🃏 Flashcards

The certification is the beginning of the obligation, not the end of it. This is the module to make your staff engineers read before anyone signs up for this.

The recurring obligations

The Significant Change Request — the concept most likely to surprise your teams

In commercial SaaS, you ship when it is ready. Inside a FedRAMP boundary, changes above a defined threshold require agency notification and, for the most material ones, review before deployment. What typically qualifies:

• New subservice providers or third-party components in the boundary
• Material changes to authentication or authorization architecture
• Changes to encryption implementation or key management
• New data types entering the boundary
• Significant infrastructure or topology change
• Changes to the boundary itself

Automating the drag away

The 20x model is genuinely better here, and this is where the investment pays back:

• Evidence generation runs in CI. The same pipeline that validated your submission runs on every deploy. Compliance state is always current because it is computed, not assembled.
• Validators are tests. A KSI check that fails should fail a build, not surface in a quarterly review three months later. Shift compliance left in exactly the way you already shifted security left.
• Deficiency tracking lives in your issue tracker, with severity-derived due dates, not in a parallel spreadsheet that only the compliance team looks at.
• Dashboards over documents. Current KSI status, open findings by age against SLA, and days-to-next-obligation, visible to the team that owns them.

ConMon as a build pipeline — the target state

  every deploy ──▶ collect evidence ──▶ validate KSIs ──▶ publish status
                        │                     │                 │
                        │                     ├─ fail ──▶ block deploy + open issue
                        │                     └─ pass ──▶ update evidence store
                        │
                        └──▶ monthly: render agency report from the same store

  Principle: there is no separate "compliance activity."
             There is a pipeline, and compliance is one of its outputs.

✅ Knowledge Check

🃏 Flashcards

Complementary to FedRAMP, aimed at a different population, and currently in an unusual state of flux. For Coursera for Business, this channel may generate a compliance requirement before any agency does.

What CMMC is and how it differs

The Cybersecurity Maturity Model Certification is the Department of Defense's program for verifying that companies in the defense industrial base adequately protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). The key structural differences:

The three levels

• Level 1 — Foundational. Basic safeguarding of FCI. Annual self-assessment.
• Level 2 — Advanced. Protection of CUI against NIST SP 800-171. Self-assessment for some contracts, third-party (C3PAO) certification for others. This is where most of the defense industrial base sits.
• Level 3 — Expert. The highest tier, adding NIST SP 800-172 elements, assessed by DIBCAC. Reserved for the most sensitive programs.

Where the program actually stands — July 2026

Does Coursera care?

✅ Knowledge Check

🃏 Flashcards

Coursera almost certainly holds SOC 2. Understanding what carries over — and what emphatically does not — determines both the real cost and the right sequencing.

The comparison

What actually carries over from SOC 2

StateRAMP — the one Coursera may be under-weighting

StateRAMP applies the FedRAMP model to state and local government, with its own program office and authorization process. It matters more to Coursera than the federal question in at least two places:

• Coursera for Campus at public universities. Public institutions are state entities. Some states extend StateRAMP-style requirements to systems handling student data at public institutions — a far larger slice of Coursera for Campus than federal service academies.
• State workforce and labor agencies running reskilling programs are a natural Coursera buyer, and they procure under state rules.
• Reciprocity runs one way and it favors you. A FedRAMP certification generally satisfies StateRAMP requirements; the reverse is not true. If you certify federally, you get the state market largely for free — and that materially improves the ROI arithmetic in Module 6.

✅ Knowledge Check

🃏 Flashcards

Work through this with your platform and security leads. Check only what is true today and evidenceable — not what is planned, not what is mostly true. Your score is saved locally, so you can return to it.

Synthesis. What to actually do, in what order, with what budget, and — most importantly — what would make you stop.

The recommendation

The 90-day qualification sprint

Sprint budget

• Readiness advisory / gap assessment support — $40K–$60K
• Internal effort — roughly 0.5 FTE across a quarter, spread over platform, security, and GTM
• No infrastructure spend, no GRC commitment, no 3PAO engagement yet

If the answer is go

If the answer is no

A "no" is not a null result — it comes with a real plan:

• Hold the line at Rung 2 deliberately. Write the product policy: no write-back to federal systems of record, no federal PII beyond work identity, no customer-uploaded content that could be CUI. Make it a documented constraint so nobody erodes it via a feature request.
• Do the platform hardening anyway. Roughly 70% of the readiness work is generic hardening that serves SOC 2, enterprise security reviews, and your own risk posture. Fund it on those merits.
• Build the CMMC-adjacent response for defense-sector Coursera for Business accounts. That channel is live now and costs almost nothing to prepare for.
• Set a review trigger, not a review date. Revisit when any of these fires: a sponsor emerges, a named competitor certifies in your exact segment, or federal pipeline crosses a dollar threshold you set now.
• Watch the June 11, 2027 date so a future "yes" is not made under time pressure.

Kill criteria — agree these before you start

The one-paragraph version for your CEO

✅ Knowledge Check

🃏 Flashcards

FedRAMP requirements are versioned and actively maintained. This course reflects the landscape as of July 27, 2026. Before making commitments, validate specifics against primary sources.

Primary — always check these first

• FedRAMP Consolidated Rules for 2026 — the operative rulebook, including the Marketplace section.
• FedRAMP Marketplace — verify any competitor's actual status here rather than trusting a press release.
• FedRAMP: Propelling Change — Consolidated Rules for 2026 (June 25, 2026 announcement).
• FedRAMP response to CISA BOD 26-04 — risk-based prioritization of security updates.
• The FedRAMP requirement repositories on GitHub — the live, versioned KSI set. Validate KSI counts and content here before planning any gap assessment.

Analysis used in building this course

• Crowell & Moring — CR26, Rev5 sunset, and critical deadlines
• Quzara — Certification Classes A–D and the 20x roadmap through 2028
• Secureframe — FedRAMP 20x goals and timeline, KSI reference, and Rev5 vs 20x cost breakdown
• AWS Public Sector — deep dive on the KSIs (note: walks 63, a different revision than the 56/61 figures — evidence the set is versioned)
• Workstreet — Phase 3 rollout and 20x vs Rev5
• RKON — why the SSP is being replaced
• FedRAMP cost analysis (2026) and Paramify cost breakdown

Competitive & market

• Blackboard / Anthology — security & certifications and the FedRAMP Moderate announcement
• Class — FedRAMP-certified offering for government training
• MeriTalk — Coursera services added to the GSA MAS contract
• Coursera for Government
• GSA — learning content providers for federal workforce modernization

CMMC

• CMMC timeline & key implementation dates
• Summit 7 — the 48 CFR final rule and the CMMC contract clause
• BDO — 48 CFR and CMMC in federal acquisition