On Oct. 15, 2026, FedRAMP published RFC-0036, the proposed rules for its 20x Class D pilot. Class D is FedRAMP's highest assurance level, built for federal workloads where a failure could cause catastrophic harm.
The pilot has 10 seats. Each requires a FedRAMP 20x Class C Certification before Dec. 1, 2026, and FedRAMP asks candidates to apply for Class C by Nov. 13. As a FedRAMP Recognized independent assessor since 2017, Sera Brynn sees one question in front of CSP leadership: pursue a seat now, or plan for 2027?
TL;DR: FedRAMP 20x Calss D Pilot
- Entry gate: 20x Class C Certification before Dec. 1. Apply for Class C and notify the FedRAMP Director by Nov. 13.
- Seats: 10. Applications run Dec. 1 to 4.
- New rules: FOCI tracking, post-quantum disclosure, 4 automated methods per KSI, and KSI data every 4 hours by API.
- Comments: close Nov. 19 on RFC-0036 and Nov. 17 on RFC-0035.
- For everyone: new vulnerability rules become mandatory Dec. 7. Rev5 High does not qualify for the pilot on its own.
What RFC-0036 Asks of Leadership
RFC-0036 proposes 10 new Key Security Indicators (KSIs). Three changes belong on the executive agenda:
- Foreign ownership becomes a governance issue. Providers must track Foreign Ownership, Control, or Influence (FOCI) and detect changes. FedRAMP will not judge FOCI. Agencies will. A funding round or offshore vendor is now a security event.
- Post-quantum readiness becomes a roadmap issue. Providers must disclose whether each key exchange and signature algorithm is post-quantum, hybrid, or neither, with a target transition date.
- Assessment shifts from documents to telemetry. Class D requires 4 automated methods per KSI (Class C requires 2), KSI data every 4 hours for up to a year, and the certification package delivered by API.
Two rules got easier. Class D services may now run on Class C or Class D certified infrastructure, so you no longer wait on your cloud host. Use of certified third parties moved from required to recommended. Separately, RFC-0035 relaxes Class D's validated-cryptography rule from MUST to SHOULD.
Key Dates
Can You Make Nov. 13?
A Class C application requires a Marketplace listing, an independent assessment completed within the prior 3 months, a package validated within the prior 7 days, and at least 2 automated validation methods for every KSI. Assessors test validation code directly. Screenshots do not count.
Working backward, your assessment must be finished before Nov. 13. That leaves less than four weeks.
Less than four weeks is enough time to know.
Rev5 High Providers: Three Paths
A Rev5 High (now Rev5 Class D) Certification does not open the pilot door. Every path to 20x Class D runs through 20x Class C first. You keep your Rev5 Class D in the meantime.
Finish a 20x Class C assessment and apply before Nov. 13
Self-hosted track
Comment on FedRAMP's self-hosted RFC, targeted for Nov. 4
Earn Class C, then hold it 6 months without corrective action
Waiting is not a neutral choice. FedRAMP has told providers without significant Rev5 progress to pivot to 20x immediately, and the Dec. 7 vulnerability rules apply whether you pursue Class D or not.
Go/No-Go Checklist for the FedRAMP 20x Class D Pilot
Review these six questions with your CTO, CISO, and head of federal sales this week:
- Is the offering listed on the FedRAMP Marketplace?
- Can an assessor finish your Class C assessment before Nov. 13?
- Does every KSI have at least 2 automated methods running, with a plan to reach 4?
- Can you deliver KSI data every 4 hours through an API?
- Are FOCI and post-quantum status documented?
- Will you meet the Dec. 7 vulnerability rules?
Six yes answers: apply for Class C now. One or two gaps: test whether they close by Nov. 13. Three or more: start Class C for the post-pilot path and submit comments on RFC-0036.
Secure Your Answer Before Nov. 13
Ten providers will earn a Class D Pilot Certification and help write the final rules. Sera Brynn's FedRAMP 20x readiness assessment tests your KSI automation against the current rules and RFC-0036, then gives your leadership a clear go/no-go.
Schedule a FedRAMP 20x Class C readiness assessment. Call us at 877.701.8000.
FAQ: FedRAMP 20x Class D Pilot
What is the FedRAMP 20x Class D?
The highest FedRAMP 20x assurance level, for federal workloads where a security failure could cause catastrophic harm. It replaces the role of the legacy Rev5 High baseline.
Who qualifies for the Class D pilot?
Cloud-hosted providers holding a 20x Class C Certification before Dec. 1, 2026. The pilot is capped at 10 participants, with applications Dec. 1 to 4.
What does RFC-0036 add?
Ten new KSIs, including FOCI tracking, plus post-quantum cryptography disclosure, 4 automated methods per KSI, KSI data every 4 hours, and certification data by API.
Can a Rev5 High provider join the pilot directly?
No. Rev5 High providers must earn 20x Class C first. They can keep their Rev5 Class D Certification.
When do comments close?
Nov. 19, 2026 for RFC-0036 and Nov. 17, 2026 for RFC-0035.