FedRAMP 20x Class D moved from roadmap to proposed rules on October 15, 2026, when FedRAMP opened RFC-0036 with the specific requirements for a Phase 4 pilot of the highest assurance level under 20x. Until now, Class D could be reached only through the Rev5 Agency path. RFC-0036 does not change that yet: it is a proposal for a pilot of at most ten providers, and eligibility requires a CR26-compliant 20x Class C Certification before December 1, 2026. Comments close on November 19. This article explains what the RFC proposes, how it differs from the earlier outline in RFC-0033, who the pilot realistically fits, and what cloud providers should do before the window closes.
What RFC-0036 Proposes for FedRAMP 20x Class D
How RFC-0036 Fits Into Phase 4
FedRAMP set the approach for Phase 4 in RFC-0033 and said the full pilot requirements would follow as a second request for comment. RFC-0036 is that second request. It proposes two new definitions, updates to six rulesets, and ten new Key Security Indicators, and it covers only cloud-hosted services. Self-hosted and hybrid-hosted services are handled in separate tracks that run in parallel, and their rules do not exist yet.
FedRAMP is explicit that none of this is settled. The RFC says additional rules and indicators may be added during or after the pilot and that existing ones are likely to change based on feedback, and RFC-0033 says the final rules from Phase 4 will be folded into the Consolidated Rules for 2027. FedRAMP also says it expects 20x Class D to provide a greater level of assurance than a legacy Rev5 Class D, and that it anticipates few commercial services will invest fully to reach it. That candor is the clearest signal of who this tier is for. Elevate’s explainer on FedRAMP High and Class D covers the Rev5 baseline that Class D means today.
The Pilot Timeline and Who Can Join
The pilot calendar comes from RFC-0033, and FedRAMP marks every date after the comment period as a target that assumes no unexpected delays.
| Date | What happens | Source |
|---|---|---|
| October 15, 2026 | RFC-0036 opens for comment | RFC-0036 |
| November 13, 2026 | Providers that apply for 20x Class C before this date and intend to join the pilot should notify the FedRAMP Director | RFC-0033 |
| November 19, 2026 | RFC-0036 comment period closes | RFC-0036 |
| December 1, 2026 | Deadline to hold a CR26-compliant 20x Class C Certification to be eligible | RFC-0033 |
| December 1 to 4, 2026 | Application window (target) | RFC-0033 |
| December 7 to 18, 2026 | Initial discussions with participants (target) | RFC-0033 |
| February 17, 2027 | Mandatory draft package submission and progress review (target) | RFC-0033 |
| March 17, 2027 | Final pilot package submission deadline (target) | RFC-0033 |
The table shows two dates that matter for most providers and several that matter only to those already inside the process. The binding date is December 1, and in practice November 13, because a provider that wants to join has to be far enough along with Class C to notify FedRAMP after submitting its application. RFC-0033 also targeted November 18 for final pilot requirements, one day before RFC-0036 closes, so expect the final text to arrive after the comment period.
Participation is deliberately narrow. FedRAMP will cap the pilot at 10 participants, limit it to providers that have already shown they can meet 20x requirements, and expect them to engage a FedRAMP Recognized Independent Assessment Service and the FedRAMP PMO. Participants should also expect to engage FedRAMP’s Technical Advisory Group, the FedRAMP Board, and interested agencies. Phase 2 pilot participants are not exempt: they need a full CR26-compliant 20x Class C Certification by December 1 like everyone else.
Class C First: The Progressive Path to Class D
The most consequential proposed rule is FRC-CLD-PCD. It says a provider seeking a 20x Class D Certification must maintain a 20x Class C Certification without corrective action for at least six months, or receive a special exemption from FedRAMP for an urgent critical need. For the Phase 4 pilot itself, a full non-pilot 20x Class C Certification is required to qualify, but the six months are not.
FedRAMP’s reasoning is stated in the rule’s notes: Class D is a very large investment for the program, and traditional High sponsorship often took many years, so the proposal breaks it into stages in which a provider demonstrates progressive assurance. The notes also settle a question for existing holders. No one with a Rev5 Class D is expected to give up that certification, but a Rev5 Class D provider moving to 20x still goes through 20x Class C first, and FedRAMP anticipates most will keep their Rev5 Class D even after earning a 20x Class D.
FedRAMP signaled this direction at its Rev5 community meeting earlier this month, where it described Class C first as its intent. RFC-0036 puts proposed rule language behind it. Elevate’s recap of the meeting covers what FedRAMP said then.
The Rules and Key Security Indicators in RFC-0036
Rules That Raise the Bar on Automation and Data Sharing
The RFC does not reproduce the existing Class D rules, only the new or modified ones, and the pattern across them is data access. Class D providers would verify and validate machine-based resources at least every three days (VDR-TFR-MVX), which matches the current Class C expectation. They would have to make all recent historical vulnerability detection and response activity available in JSON for automated retrieval, updated persistently and at least every seven days (VER-TFR-MRH). That is a change from SHOULD to MUST for Class D.
Two further rules push the same direction. The Security Decision Record would have to include historical Key Security Indicator metrics: a 30-day summary, a summary of up to a year where available, and metric data every four hours for up to a year (SDR-CSX-KMT). And providers would have to supply all machine-readable parts of the certification package through a web-compatible API (CDS-CSX-API), which FedRAMP calls a new rule for Class D. The practical reading is that a Class D agency customer would pull evidence on demand instead of reading a package. Elevate’s Vulnerability Management as a Service covers the detection and evaluation layer these rules depend on.
A New Rule on Indicators of Compromise
VER-EVA-IOC is entirely new. It says Class D providers SHOULD evaluate detected vulnerabilities in the context of the cloud service offering to decide when the likelihood of exploitation is high enough to start forensic activity, such as searching for indicators of compromise, and then do so. FedRAMP notes that it may also be ported to Rev5 in the Consolidated Rules for 2027. That note matters beyond the pilot: a rule written for Class D may reach Rev5 providers within a year.
Post-Quantum Cryptography Status
CMU-CSO-PQS would require Class D providers to document the post-quantum status of the digital key establishment and digital signatures that protect federal customer data. For each algorithm, the provider states whether it is post-quantum, part of a hybrid implementation with post-quantum cryptography, or neither, and gives a target date to transition it where that is available and applicable. It is a documentation requirement, not a mandate to migrate, and FedRAMP describes it as new for the Phase 4 pilot and for the 2027 rules.
Hosting and Third-Party Rules
FRC-CLD-CCH says a 20x Class D provider must be deployed on a Class C or Class D Certified infrastructure or platform offering, or meet Class D self-hosted or hybrid-hosted rules that do not exist yet. This differs from RFC-0033, which had said cloud-hosted Class D services must run on a Class D Certified infrastructure. FRC-CLD-CTP also softens a position. RFC-0033 said Class D services must use only Class B, C, or D Certified third-party resources in their assessment scope, while RFC-0036 says providers SHOULD limit the likely handling of federal customer data to third-party resources included in a Class B, C, D, or G Certified offering.
Ten New Key Security Indicators
RFC-0036 adds ten Key Security Indicators specifically for Class D, based on the additional capabilities expected from a High baseline. Six concern assurance and automation, and four concern foreign ownership, control, or influence.
| Indicator | Name | What it asks of the provider |
|---|---|---|
| KSI-CMT-TNP | Testing in Non-Production Environments | Planned changes are persistently verified and validated in non-production environments before production |
| KSI-IAM-MST | Monitoring Suitability | Privileged and high-risk resources, including personnel, funds, and technology such as AI agents, have access, privileges, suitability, and activity persistently reviewed |
| KSI-IAM-MPI | Managing Personnel Identities | Personnel background and identity are persistently verified based on privileges and roles |
| KSI-RPL-MCA | Maintaining Cryptographic Access | The ability to make critical information available after cryptographic key loss or failure is persistently reviewed |
| KSI-SVC-IED | Inspecting Encrypted Data | Encrypted data is inspected in transit for malicious content and compliance with data policies |
| KSI-SVC-UAS | Using Automated Security | Security-critical processes are supported by automated tools for compliance and consistency |
| KSI-PIY-DFC | Detecting FOCI Changes | Changes in foreign ownership, control, or influence are detected and acted on |
| KSI-PIY-RFP | Reviewing Foreign Persons | Foreign persons able to direct or decide matters affecting the offering are persistently reviewed |
| KSI-PIY-RFB | Reviewing Foreign Businesses | Foreign business relationships that support the offering are persistently reviewed for ongoing risks |
| KSI-PIY-MFD | Maintaining FOCI Determinations or Mitigations | U.S. agency determinations or mitigation agreements covering the operating entity are persistently reviewed and maintained |
The table shows a tier built around persistence. Seven of the ten indicators use the word persistently, and FedRAMP says Class D providers will need at least four different automated methods to track Key Security Indicator status and are encouraged to go well beyond that. It also calls Class D competitive: providers that invest in automation, greater assurance, and fast response and communication are expected to outperform those that only meet the minimum. One detail stands out for teams adopting AI. KSI-IAM-MST names AI agents among the resources whose access and activity must be reviewed, which connects Class D to the agent governance covered in Elevate’s AIUC-1 readiness work.
FOCI Is Documentation and Monitoring, Not a Determination
The RFC defines foreign ownership, control, or influence as a condition in which a foreign entity can direct or influence the management or operations of a cloud service offering used by agencies, and it adopts the definition of a foreign person in 31 CFR 800.224. The important rule is FRC-FRA-FOD: FedRAMP MUST NOT request details of a provider’s FOCI and will not decide whether it is acceptable. Agencies make that decision for their own use.
What FedRAMP will verify is that the provider knows and tracks its FOCI, and that it can supply the information to customers when a contract requires it. The Key Security Indicator notes add that sensitive details should not appear in indicator metrics. For a provider with foreign investors, offshore engineering or support staff, or foreign subsidiaries, the work is a persistent register and review process, not a disclosure to FedRAMP.
Who the FedRAMP 20x Class D Pilot Realistically Fits
Eligibility Is Narrow by Design
The combined effect of the proposals is a small field. A provider needs a full CR26-compliant 20x Class C Certification before December 1, a recognized independent assessor, the capacity to engage the PMO, the Technical Advisory Group, the Board, and agencies during the pilot, and a place among at most ten participants. FedRAMP itself says it expects Class D to demand considerable investment and that few commercial services will make it. For most cloud providers, the practical question is not whether to join the pilot but what the pilot reveals about where assurance expectations are heading.
What It Means for Rev5 Class D Holders
Nothing is taken away. FedRAMP states that no Rev5 Class D holder is expected to give up that certification, and it expects most to keep it. The new question is whether a second, 20x Class D certification is worth pursuing, and the proposed path answers the first step: a 20x Class C Certification. Rev5 itself stops accepting new applications on June 11, 2027, and existing Rev5 holders stay certified through at least December 31, 2028, so Rev5 Class D providers have time but not an unlimited horizon. Elevate’s Rev5 authorization and transition strategy covers the sequencing.
What It Means for Class C Providers
Class D is not required of a Class C provider, but the RFC is the clearest preview available of where FedRAMP is taking assurance. Three signals are worth tracking. Data-sharing rules are moving toward APIs and frequent automated updates. VER-EVA-IOC may reach Rev5 in the 2027 rules. And identity reviews are extending to non-human actors such as AI agents. Elevate’s Class C Rules Reference lists the rules Class C providers already face, which is the baseline these proposals build on.
What Cloud Providers Should Do Before Comments Close on November 19
Four actions follow from the RFC, in order of how soon each date bites.
Decide Whether to Comment
FedRAMP prefers comments on the RFC’s GitHub thread and also accepts them through a form. It asks specifically about the clarity, applicability, reasonability, and achievability of the proposed rules and indicators, and RFC-0033 says it prefers targeted feedback to general commentary. Questions worth raising include what counts as recent historical activity under the JSON rule, and how a provider should determine which foreign persons are able to direct or decide matters affecting the offering. Comments close on November 19, so a provider with a view has about five weeks.
Check Your Class C Position Against December 1
Eligibility for the pilot depends on holding a CR26-compliant 20x Class C Certification before December 1, and a provider that applies before November 13 and intends to join should notify the FedRAMP Director after submitting its application. For a provider that has not yet applied for 20x Class C, December 1 is a very tight date. Providers outside the pilot lose nothing by building toward Class C, because it is the required first step for any 20x Class D path. Elevate’s FedRAMP 20x vs Rev5 Path Finder helps choose the starting point.
Inventory FOCI and Post-Quantum Facts Now
Both proposed documentation requirements can start before any rule is final. For FOCI, list owners and investors, foreign persons with authority over the offering, foreign business relationships that support it, and any determinations or mitigation agreements issued by U.S. agencies. For cryptography, list the algorithms used for key establishment and digital signatures to protect federal customer data, classify each as post-quantum, hybrid, or neither, and note a target date where a transition is planned. Neither task needs the pilot, and both are worth having ready whatever the final rules say.
Test Your Automation Against the Data-Sharing Rules
Ask whether the current pipeline could supply the machine-readable package through an API, update historical vulnerability activity in JSON at least every seven days, and produce Key Security Indicator metrics every four hours for up to a year. Also count the automated methods used to track Key Security Indicator status, since FedRAMP expects at least four for Class D. If the answer to any of these is no, the gap is worth finding before a certification timeline depends on it. Elevate’s FedRAMP 20x readiness service covers that assessment. If you are weighing Class C, Class D, or both, book a call with an Elevate advisor to map the sequence against your own dates.
Conclusion
RFC-0036 is the first detailed look at what FedRAMP 20x Class D would ask of a provider: persistent evidence, APIs instead of packages, foreign ownership tracking, post-quantum documentation, and a Class C foundation. It is a proposal for a pilot of at most ten providers, so it will not change most providers’ plans this quarter. What it does change is the picture of where assurance is heading, and two of its ideas, the indicators of compromise evaluation and the move toward automated data sharing, may reach Rev5 in the 2027 rules.
The decisions that need action are small and dated: whether to comment before November 19, and whether the Class C position supports December 1. The rest is preparation that pays off whatever the final rules say: a FOCI register, a cryptography inventory, and an automation review.
FedRAMP and its recognized assessors certify, and Elevate Consult prepares cloud providers for it, across Rev5 maintenance, 20x Class C, and the steps toward Class D. Book a call with an Elevate advisor to review where your program stands against RFC-0036.
Key Takeaways
RFC-0036 previews FedRAMP 20x Class D, and the decisions it forces are few and dated.
- It is a proposal. RFC-0036 opened on October 15, 2026 and closes on November 19; Class D remains available only through Rev5 until the pilot produces final rules.
- Eligibility is narrow. The pilot is capped at 10 providers, each holding a CR26-compliant 20x Class C Certification before December 1, 2026.
- Class C comes first. The proposed rule requires six months of 20x Class C without corrective action, or an exemption, before 20x Class D; the pilot itself waives the six months.
- Data access defines the tier. APIs for certification data, JSON vulnerability history updated at least every seven days, and indicator metrics every four hours.
- FOCI is tracked, not determined. FedRAMP will not decide on foreign ownership; providers must know it, track it, and be able to share it.
- Rev5 Class D holders keep their certification. FedRAMP does not expect anyone to give it up.
Frequently Asked Questions
What is RFC-0036?
RFC-0036 is a FedRAMP request for comment titled FedRAMP 20x Class D Cloud-Hosted Pilot Requirements. FedRAMP opened it on October 15, 2026, with comments due November 19, 2026. It proposes two new definitions, changes to six rulesets, and ten new Key Security Indicators to test in the Phase 4 pilot of the highest assurance level under FedRAMP 20x. It covers cloud-hosted services only, and FedRAMP says the rules may change during and after the pilot.
Can a cloud provider get FedRAMP 20x Class D today?
No. Class D is currently available only through the Rev5 Agency path, and 20x Class D exists only as a proposed pilot. FedRAMP plans to run the Phase 4 pilot during the first half of fiscal year 2027 with at most 10 participants, and the final rules are expected to be folded into the Consolidated Rules for 2027. Providers should treat 20x Class D as a future option, not an available one.
What does a provider need to join the FedRAMP 20x Class D pilot?
A CR26-compliant FedRAMP 20x Class C Certification received before December 1, 2026, which is the single requirement to apply. Providers that apply for Class C before November 13 and intend to join should notify the FedRAMP Director after submitting. Participants must also engage a FedRAMP Recognized Independent Assessment Service and the FedRAMP PMO, and FedRAMP will limit the pilot to 10 participants. Phase 2 pilot participants are not exempt from the Class C requirement.
How is 20x Class D different from Rev5 Class D?
Rev5 Class D follows the traditional path: an agency sponsors the certification against the NIST SP 800-53 High baseline. The proposed 20x Class D adds persistent evidence through Key Security Indicators, API access to certification data, foreign ownership tracking, and post-quantum cryptography documentation, and it requires a prior 20x Class C Certification. FedRAMP says it expects 20x Class D to provide a greater level of assurance than Rev5 Class D, and that no one with a Rev5 Class D is expected to give it up.
What is FOCI in FedRAMP 20x Class D?
FOCI means foreign ownership, control, or influence: a condition in which a foreign entity can direct or influence the management or operations of a cloud service offering used by agencies. Under the proposed rules, FedRAMP will not request details of a provider’s FOCI or decide whether it is acceptable. Instead, providers must persistently review foreign persons, foreign business relationships, and any government determinations or mitigation agreements, and be able to share that information with customers under contract. Agencies decide whether a provider’s FOCI is acceptable for their use.