FedRAMP Just Proposed the 20x Class D Rules. Here's What to Know.

On October 15, 2026, FedRAMP published RFC-0036, its first detailed proposal for 20x Class D. Here are the five things to take away from it. 

1. It’s a proposal, not the final rulebook

RFC-0036 is a Request for Comment written for the Phase 4 pilot, and FedRAMP states upfront that the rules will change based on what it learns, just as we saw with the previous pilots and RFCs.

Some things have already moved. In September’s RFC-0033, Class D services had to run on Class D certified infrastructure, but RFC-0036 now accepts Class C or Class D. A rule limiting third-party services to certified offerings shifted from a MUST to a SHOULD, and it now applies only where federal customer data is likely to be handled.

FedRAMP plans to release final pilot requirements on November 18, with the final rules going into the Consolidated Rules for 2027. This RFC covers cloud-hosted services only. Rules for self-hosted and hybrid services are being developed separately, with a proposal targeted for February 2027.

2. You’ll go through Class C first

Outside the pilot, the proposal requires holding 20x Class C for six months without corrective action before you can apply for Class D, unless FedRAMP grants an exemption for an urgent need. FedRAMP’s reasoning is practical: the program isn’t fee-funded, and Class D reviews take a lot of government time.

The pilot skips the six-month wait but requires a full 20x Class C certification by December 1, 2026, and it’s capped at 10 participants. Rev 5 Class D holders keep their existing certification. To reach 20x Class D, though, they’d also go through 20x Class C, and FedRAMP expects most to end up holding both.

3. Class D means more data, shared more directly

Validation stays at every three days, the same as Class C. What goes up is how much history you keep and how easily agencies can get to it. Under the proposal:

• The full certification package is delivered by API 
• The Security Decision Record includes up to one year of Key Security Indicator (KSI) metric history, with data at four-hour intervals 
• Vulnerability detection and response history is available in JSON and updated at least weekly, moving from a SHOULD to a MUST for Class D 

It also adds six technical KSIs, covering areas like testing changes in non-production environments, inspecting encrypted traffic, and ongoing suitability reviews for privileged access, which explicitly include AI agents. Providers would need at least four automated methods to track KSI status. FedRAMP also wants Class D to be competitive, so providers who go past the minimum will stand out. The proposal also includes a post-quantum cryptography status requirement and guidance on hunting for indicators of compromise.

4. FOCI is the new theme

Four of the ten new KSIs cover foreign ownership, control, or influence (FOCI). These KSIs focus on detecting FOCI changes, reviewing foreign persons who can direct the offering, reviewing foreign business relationships, and maintaining any government FOCI determinations or mitigation agreements.

FedRAMP won’t collect your FOCI details or judge them; agencies make that call. FedRAMP would only check that you track FOCI and can share the details with an agency under contract, so you do the work once and reuse it across customers. Sensitive details also stay out of KSI metrics.

Most of this information sits with legal, finance, procurement, and HR, so security can’t meet these KSIs alone. Best practice is to have someone like the general counsel own the review, with security owning the schedule, the evidence, and the metrics. Companies that already manage FOCI with DCSA or CFIUS have a head start.

5. Comment now, and don’t build to it as final

The comment window is short, and the changes since September show that feedback matters. FedRAMP has asked for specific, targeted comments. Two worth raising:

• Whether “foreign persons able to direct or decide matters” means only the board and executives or also extends to foreign-national engineers with production access 
• How assessors should validate FOCI reviews they aren’t supposed to see 

If Class D is on your roadmap, the safest move is getting to 20x Class C, since the proposed six-month clock starts there. After that, invest in the automation and metric history that any final version is likely to require. 

Talk to A-LIGN’s FedRAMP experts about where your organization stands and what to prioritize.