SOC 2 to FedRAMP 20x: the complete gap map.

The requirement. Apply the FedRAMP Minimum Assessment Scope (MAS) to identify and document the scope of the cloud service offering to be assessed for FedRAMP authorization.

Gap from SOC 2. While a production inventory and service description exist, the FedRAMP MAS requires a precisely defined authorization boundary — every component, data flow, external connection, and service within scope documented in an OSCAL-formatted System Security Plan. This is substantially more prescriptive than SOC 2.

The requirement. Determine how authorization data will be shared with all necessary parties in alignment with the FedRAMP Authorization Data Sharing (ADS) process and persistently address all related requirements and recommendations.

Gap from SOC 2. No SOC 2 control addresses how security authorization data is shared with government customers and agencies. An ADS process, machine-readable package, and data-sharing agreements with agency AOs must be developed from scratch.

The requirement. Document the vulnerability detection and vulnerability response methodology used within the cloud service offering in alignment with the FedRAMP Vulnerability Detection and Response (VDR) process.

Gap from SOC 2. Vulnerability scanning and pen testing are in place (VPM-1, VPM-2, IAO-2, OPS-1). FedRAMP VDR requires a formal, documented VDR methodology with defined detection timelines, FedRAMP-specific remediation SLAs (Critical: 15 days, High: 30 days, Moderate: 90 days), and integration into the ConMon reporting process.

The requirement. Determine how significant changes will be tracked and how all necessary parties will be notified in alignment with the FedRAMP Significant Change Notifications (SCN) process.

Gap from SOC 2. External change communication exists (GOV-6, GOV-13) and change management is enforced (CHG-1). FedRAMP SCN defines specific categories of 'significant changes' and requires advance notification to all agency AOs and the FedRAMP PMO — a formal Significant Change Request (SCR) process must be established.

The requirement. Maintain a plan and process for providing Ongoing Authorization Reports and Quarterly Reviews for all necessary parties in alignment with the FedRAMP Collaborative Continuous Monitoring (CCM) process.

Gap from SOC 2. FedRAMP's CCM program — quarterly reviews, ongoing authorization reports, and collaborative monitoring with agency AOs — has no SOC 2 equivalent. A full ConMon program must be built, including reporting cadence, templates, and agency engagement model.

The requirement. Develop secure by default configurations and provide guidance for secure configuration of the cloud service offering to customers in alignment with the FedRAMP Secure Configuration Guide (SCG) process.

Gap from SOC 2. Internal configuration management exists (CFG-1, NET-5). FedRAMP SCG additionally requires publishing customer-facing secure configuration guidance and maintaining a secure-by-default configuration baseline — neither of which is required by SOC 2.

The requirement. Operate a secure inbox to receive critical communication from FedRAMP and other government entities in alignment with FedRAMP Security Inbox (FSI) requirements.

Gap from SOC 2. A dedicated, monitored security inbox for receiving FedRAMP and agency security communications is a FedRAMP-specific operational requirement with no SOC 2 equivalent. Must be established and staffed.

The requirement. Persistently validate, assess, and report on the effectiveness and status of security decisions and policies implemented within the cloud service offering, in alignment with FedRAMP 20x Persistent Validation and Assessment (PVA) process.

Gap from SOC 2. SOC 2 requires annual control self-assessments (IAO-1). FedRAMP 20x PVA requires continuous, automated, machine-readable validation of KSI compliance — a fundamentally different paradigm. A compliance-as-code pipeline producing persistent, auditable evidence must be built.

The requirement. Integrate FedRAMP's Incident Communications Procedures (ICP) into incident response procedures and persistently address all related requirements and recommendations.

Gap from SOC 2. IR policies and procedures exist (IRO-2, IRO-3). FedRAMP ICP adds specific government notification timelines (e.g., 1-hour notification to US-CERT/CISA for major incidents), agency AO notification, and FedRAMP PMO reporting — none of which are required by SOC 2.

The requirement. Ensure that cryptographic modules used to protect potentially sensitive federal customer data are selected and used in alignment with the FedRAMP 20x Using Cryptographic Modules (UCM) guidance.

Gap from SOC 2. Encryption controls exist for data at rest and in transit (CRY-3, CRY-4, NET-1). FedRAMP UCM specifically requires FIPS 140-2 or 140-3 validated cryptographic modules — a hard technical requirement not mandated by SOC 2. All crypto implementations must be audited against FIPS validation.

The requirement. Log and monitor modifications to the cloud service offering.

Gap from SOC 2. Change logging processes and log management are in place (CHG-1, MON-2). FedRAMP 20x emphasizes persistent, automated logging of all changes with tamper-resistant, machine-readable audit trails. Completeness of logging across all cloud-native components must be validated.

The requirement. Execute changes to machine-based information resources through redeployment of version-controlled immutable resources rather than direct modification wherever reasonable.

Gap from SOC 2. SOC 2 requires change management processes but does not require immutable infrastructure or GitOps deployment models. This requires adopting IaC (Terraform, CloudFormation), container-based deployments, disabling direct production access (SSH/RDP), and enforcing all changes through version-controlled pipelines.

The requirement. Automate persistent testing and validation of changes throughout deployment.

Gap from SOC 2. CHG-1 requires changes be tested prior to production. FedRAMP 20x requires automated, persistent testing integrated throughout the entire deployment pipeline (SAST, DAST, IaC scanning, automated regression tests as mandatory pipeline gates) — not just pre-deployment manual testing.

The requirement. Persistently review the effectiveness of documented change management procedures.

Gap from SOC 2. Change procedures exist and are assessed annually (CHG-1, IAO-1). FedRAMP adds the requirement for persistent (continuous or frequent automated) review of change procedure effectiveness — beyond the annual cadence typical in SOC 2.

The requirement. Persistently ensure all machine-based information resources are configured to limit inbound and outbound network traffic.

Gap from SOC 2. Firewall controls are in place (IAC-4, NET-3, NET-4). FedRAMP requires persistent, automated enforcement and validation that every cloud resource (not just network-level firewalls) is configured to deny traffic by default, with machine-readable evidence of continuous compliance.

The requirement. Persistently ensure machine-based information resources have a minimal attack surface and that lateral movement is minimized if compromised.

Gap from SOC 2. Network segmentation and firewalls are addressed (NET-2 through NET-5). FedRAMP extends this to require micro-service architecture, east-west traffic controls, and automated, persistent validation that lateral movement paths are blocked — not just periodic firewall reviews.

The requirement. Use logical networking and related capabilities to enforce traffic flow controls.

Gap from SOC 2. Network segmentation and access controls are in place (NET-2, IAC-6, NET-4). FedRAMP requires cloud-native logical networking (VPCs, subnets, route tables, security groups) to be formally documented, and traffic flow controls to be continuously validated with automated tooling.

The requirement. Strictly define the functionality and privileges for infrastructure and services.

Gap from SOC 2. Access restrictions for key systems are in place (IAC-1, IAC-3, IAC-4, IAC-5). FedRAMP requires this be implemented at the infrastructure level — containers and serverless functions with strictly defined, minimal functionality and privileges enforced via code, validated automatically.

The requirement. Persistently review the effectiveness of protection against denial of service attacks and other unwanted activity.

Gap from SOC 2. Intrusion detection and firewalls are in place (MON-1, NET-4). FedRAMP requires persistent review of DDoS protection effectiveness — documented evidence of cloud-native DDoS protection (e.g., AWS Shield, Azure DDoS Protection) with testing and review on an ongoing basis.

The requirement. Appropriately optimize machine-based information resources for high availability and rapid recovery.

Gap from SOC 2. BC/DR plans exist (BCD-1, BCD-2). FedRAMP requires cloud-native HA architecture (multi-AZ, auto-scaling, load balancing, automated failover) to be formally documented with architecture diagrams and linked to authorization boundary documentation.

The requirement. Persistently ensure cloud-native machine-based information resources are implemented based on the host provider's best practices and documented guidance.

Gap from SOC 2. Hardening standards exist (NET-5, CFG-1). FedRAMP requires persistent, automated validation that all cloud resources comply with the cloud provider's Well-Architected Framework and security best practices — with machine-readable evidence of ongoing compliance.

The requirement. Use automated services to persistently assess the security posture of all machine-based information resources and automatically enforce their intended operational state.

Gap from SOC 2. Configuration management and self-assessments exist. FedRAMP requires automated Cloud Security Posture Management (CSPM) tooling that continuously detects and automatically remediates configuration drift — beyond what SOC 2 requires.

The requirement. Persistently review the effectiveness of training given to all employees on policies, procedures, and security-related topics.

Gap from SOC 2. Annual security awareness training is required (SAT-1). FedRAMP adds persistent review of training effectiveness — including phishing simulations, knowledge assessments, and documented review of outcomes — beyond the annual completion tracking typical in SOC 2.

The requirement. Persistently review the effectiveness of role-specific training given to employees in high-risk roles, including at least roles with privileged access.

Gap from SOC 2. General awareness training exists (SAT-1). FedRAMP requires a distinct role-based training program for privileged users, system administrators, and security staff — with persistent review of effectiveness beyond annual completion metrics.

The requirement. Persistently review the effectiveness of role-specific training given to development and engineering staff that covers best practices for delivering secure software.

Gap from SOC 2. General security awareness training exists (SAT-1). FedRAMP requires dedicated, persistent review of developer-specific training effectiveness — covering secure coding, OWASP Top 10, Secure by Design, and secrets management. This is a distinct track from general awareness training.

The requirement. Persistently review the effectiveness of role-specific training given to staff involved with incident response or disaster recovery.

Gap from SOC 2. IR plan testing exists (IRO-1) and IR policies are established (IRO-2). FedRAMP requires persistent review of training effectiveness for IR/DR staff specifically — including tabletop exercises with documented after-action reports and evidence that lessons learned are incorporated.

The requirement. Enforce multi-factor authentication (MFA) using methods that are difficult to intercept or impersonate (phishing-resistant MFA) for all user authentication.

Gap from SOC 2. MFA is enforced for remote access (IAC-12). FedRAMP specifically requires phishing-resistant MFA (FIDO2/WebAuthn hardware keys, or PIV/CAC) for ALL user authentication — not just remote access, and not just TOTP-based MFA. Current MFA methods must be evaluated against this standard.

The requirement. Use secure passwordless methods for user authentication and authorization when feasible, otherwise enforce strong passwords with MFA for authentication.

Gap from SOC 2. Password policies and MFA for remote access exist (IAC-11, IAC-12). FedRAMP prefers passwordless methods (FIDO2/WebAuthn, PIV/CAC) and requires phishing-resistant MFA where passwordless is not feasible — a higher bar than standard MFA required by SOC 2.

The requirement. Enforce appropriately secure authentication methods for non-user accounts and services.

Gap from SOC 2. Unique authentication for production systems exists (CRY-1, CRY-5, IAC-3). FedRAMP extends this to all service accounts, API keys, and machine identities — requiring automated secret management, certificate-based auth, and prohibition of long-lived static credentials.

The requirement. Use a least-privileged, role and attribute-based, and just-in-time security authorization model for all user and non-user accounts and services.

Gap from SOC 2. Access request and review processes exist (IAC-2, IAC-7, IAC-9). JIT access — time-limited, approval-gated, automatically expiring access grants — is not required by SOC 2. PAM tooling with JIT workflows must be implemented for all privileged and sensitive access.

The requirement. Persistently ensure that identity and access management employs measures to ensure each user or device can only access the resources they need.

Gap from SOC 2. Least privilege controls and access restrictions exist (IAC-1, IAC-2, IAC-3, IAC-5). FedRAMP requires persistent, automated validation of least privilege across all resources — including non-user service accounts, cloud roles, and API keys — with continuous evidence collection.

The requirement. Automatically disable or otherwise secure accounts with privileged access in response to suspicious activity.

Gap from SOC 2. Intrusion detection and incident response procedures exist (MON-1, IRO-3). FedRAMP requires automated response — accounts must be automatically locked or suspended upon suspicious activity detection without manual intervention. UEBA or SIEM-driven automated remediation must be implemented.

The requirement. Securely manage the lifecycle and privileges of all accounts, roles, and groups, using automation.

Gap from SOC 2. Access management processes exist (IAC-2, IAC-7, IAC-8, IAC-9). FedRAMP requires these be automated — SCIM-based provisioning/de-provisioning, automated access reviews, automated disablement upon termination — with persistent evidence of automated lifecycle management.

The requirement. Persistently review the effectiveness of documented incident response procedures.

Gap from SOC 2. IR policies are established and the plan is tested (IRO-1, IRO-2, IRO-3). SOC 2 typically requires annual testing. FedRAMP requires persistent review of IR procedure effectiveness with more frequent exercises and documented continuous improvement — plus FedRAMP-specific ICP integration.

The requirement. Persistently review past incidents for patterns or vulnerabilities.

Gap from SOC 2. Incident management procedures and log management exist (IRO-3, MON-2). A formal process for periodically reviewing past incident history to identify patterns, systemic vulnerabilities, and security trends — with documented findings fed back into risk assessment — must be formalized.

The requirement. Generate incident after action reports and persistently incorporate lessons learned.

Gap from SOC 2. Incident management procedures exist (IRO-3). Formal after action reports (AARs) with documented lessons learned are not explicitly required by SOC 2. FedRAMP requires AARs for significant incidents and evidence that lessons are incorporated into updated procedures and controls.

The requirement. Operate a Security Information and Event Management (SIEM) or similar system(s) for centralized, tamper-resistant logging of events, activities, and changes.

Gap from SOC 2. Log management is in place (MON-2). SOC 2 does not require a SIEM specifically. FedRAMP requires a centralized SIEM with tamper-resistant log storage, defined retention periods (minimum 90 days hot / 1 year cold), integration of all in-scope log sources, and automated alerting on security events.

The requirement. Persistently review and audit logs.

Gap from SOC 2. Log management and periodic assessments exist (MON-2, IAO-1). FedRAMP requires persistent, documented log review with automated alerting on anomalies, evidence of regular review activity (tickets, dispositions), and defined escalation procedures — not just annual assessment coverage.

The requirement. Persistently evaluate and test the configuration of machine-based information resources, especially infrastructure as code.

Gap from SOC 2. Configuration management exists (CFG-1) and periodic assessments are conducted (IAO-1). FedRAMP requires persistent, automated IaC security scanning (e.g., Checkov, tfsec, KICS) integrated into CI/CD pipelines — which is not required by SOC 2.

The requirement. Maintain a list of information resources and event types that will be logged, monitored, and audited, then do so.

Gap from SOC 2. Log management and monitoring procedures exist (MON-2, OPS-1). FedRAMP requires a formally documented, maintained list of all information resources and the specific event types logged for each — providing traceability between assets and their logging coverage.

The requirement. Use a least-privileged, role and attribute-based, and just-in-time access authorization model for access to log data based on organizationally defined data sensitivity.

Gap from SOC 2. General access controls and reviews exist (IAC-2, IAC-7). JIT access specifically scoped to log/audit data is not required by SOC 2. Must implement separate JIT access controls for SIEM and log data with automated approval workflows.

The requirement. Use authoritative sources to automatically generate real-time inventories of all information resources when needed.

Gap from SOC 2. A production inventory exists (AST-3). FedRAMP requires real-time, automatically generated inventories from authoritative cloud sources (cloud provider APIs, CSPM tools) — not static spreadsheets — covering 100% of in-scope resources within the authorization boundary.

The requirement. Persistently review the effectiveness of the provider's vulnerability disclosure program.

Gap from SOC 2. Vulnerability scanning exists (VPM-2) but a public-facing vulnerability disclosure program (VDP) — allowing external researchers to report vulnerabilities — is not required by SOC 2. FedRAMP requires a VDP and persistent review of its effectiveness.

The requirement. Persistently review the effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles.

Gap from SOC 2. An SDLC methodology exists (CHG-3). FedRAMP requires persistent review of SDLC security effectiveness and explicit alignment with CISA Secure by Design principles — including threat modeling, SAST/DAST integration, and documented developer security training outcomes.

The requirement. Persistently review the effectiveness of the organization's investments in achieving security objectives.

Gap from SOC 2. Risk management program and self-assessments exist (RSK-3, IAO-1). FedRAMP requires persistent review of security investment effectiveness — including whether security tooling, staffing, and processes are achieving KSI outcomes — with documented evidence feeding back into the authorization package.

The requirement. Persistently review executive support for achieving the organization's security objectives.

Gap from SOC 2. Board oversight and governance structures exist (GOV-1 through GOV-4). FedRAMP extends this to require persistent review of executive support specifically for security objectives and FedRAMP program resources — not just annual board meetings.

The requirement. Persistently review desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).

Gap from SOC 2. RTO/RPO are typically defined within BC/DR plans (BCD-1, BCD-2). FedRAMP requires these be formally documented in the SSP, persistently reviewed for relevance, and validated through functional tests — with documented evidence that actual recovery meets defined objectives.

The requirement. Persistently review the alignment of recovery plans with defined recovery objectives.

Gap from SOC 2. BC/DR plans exist and are tested (BCD-1, BCD-2). FedRAMP requires persistent review that recovery plans remain aligned with current system architecture and defined RTO/RPO — including government-specific recovery priorities and agency customer notification procedures during disruptions.

The requirement. Persistently review the alignment of machine-based information resource backups with defined recovery objectives.

Gap from SOC 2. Backup processes are documented (GOV-5). FedRAMP requires persistent review that backup configurations (frequency, retention, geographic distribution) actually align with defined RPO — with automated monitoring and evidence of regular alignment validation.

The requirement. Persistently test the capability to recover from incidents and contingencies, including alignment with defined recovery objectives.

Gap from SOC 2. BC/DR and IR plans are tested (BCD-2, IRO-1). FedRAMP requires persistent functional testing — actual failover exercises, not just tabletop — with documented evidence that recovery met defined RTO/RPO targets. Annual testing minimum, with lessons learned incorporated.

The requirement. Manage configuration of machine-based information resources using automation.

Gap from SOC 2. A configuration management system exists (CFG-1). FedRAMP requires configuration management to be fully automated — all resource configurations defined as code, deployed via automated pipelines, with drift detection and automated remediation. Manual configuration changes to production must be eliminated.

The requirement. Automate management, protection, and regular rotation of digital keys, certificates, and other secrets.

Gap from SOC 2. Encryption key access is restricted (CRY-2). Automated secret rotation — short-lived credentials, automated certificate renewal, secrets vault with automated rotation policies — is not required by SOC 2. Long-lived static secrets and manually rotated credentials must be eliminated.

The requirement. Implement improvements based on persistent evaluation of information resources for opportunities to improve security.

Gap from SOC 2. Self-assessments and vulnerability scanning provide improvement inputs (IAO-1, VPM-2). FedRAMP requires a persistent, systematic process for evaluating all information resources for security improvement opportunities — with automated tooling generating continuous findings that feed into an improvement backlog.

The requirement. Persistently review plans, procedures, and the state of information resources after making changes to limit and remove unwanted residual elements that would likely negatively affect the confidentiality, integrity, or availability of federal customer data.

Gap from SOC 2. Change management procedures exist (CHG-1). Post-change residual risk review — specifically checking for orphaned resources, unintended data exposures, or configuration remnants after changes — is more specific than SOC 2 requirements. Must be formalized as a post-deployment verification step.

The requirement. Remove unwanted federal customer data promptly when requested by an agency in alignment with customer agreements, including from backups if appropriate.

Gap from SOC 2. Customer data deletion and retention procedures exist (DCH-1, AST-2). FedRAMP adds agency-directed data removal — including from backups — within defined timeframes and with documented evidence of removal completion. Processes must be enhanced to cover backup purging and provide agency notification of completion.

The requirement. Encrypt or otherwise secure network traffic.

Gap from SOC 2. Network traffic encryption is in place (NET-1, IAC-13). FedRAMP requires FIPS-approved TLS (TLS 1.2+ with approved cipher suites) for all traffic carrying federal data, and disabling non-compliant protocols. All endpoints must be audited for TLS compliance and weak ciphers must be disabled.

The requirement. Persistently validate the authenticity and integrity of communications between machine-based information resources using automation.

Gap from SOC 2. Encryption of transmissions exists (NET-1). Persistent, automated validation of communication authenticity and integrity (mutual TLS, certificate validation, signed API responses) between internal services is not required by SOC 2 and requires additional implementation.

The requirement. Use cryptographic methods to validate the integrity of machine-based information resources.

Gap from SOC 2. Configuration management and assessments exist (CFG-1, IAO-1). Cryptographic integrity validation — container image signing, binary signing, IaC artifact verification using tools like Sigstore/Cosign — is not required by SOC 2 and must be implemented.

The requirement. Persistently identify, review, and mitigate potential supply chain risks.

Gap from SOC 2. Vendor management and third-party agreements exist (TPM-1, TPM-2). FedRAMP adds persistent supply chain risk identification — SBOM maintenance, CISA Secure Software Development Attestation requirements, and formal supply chain risk assessment for all critical suppliers — beyond what SOC 2 requires.

The requirement. Automatically monitor third-party software information resources for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services.

Gap from SOC 2. Vendor management and vulnerability scanning exist (TPM-2, VPM-2). Automated monitoring of upstream third-party software for vulnerabilities (SCA tooling, dependency scanning, contractual vulnerability notification clauses) is not explicitly required by SOC 2 and must be implemented.