FedRAMP Class D proposals raise the bar on continuous evidence

FedRAMP has opened two comment periods that would shape Class D cloud requirements and cryptographic-module rules for its 20x program. The proposals matter because they push providers to prove ongoing assurance with current evidence, automated tracking, and clearer governance over crypto changes and third-party risk.

Why it matters: - FedRAMP’s draft Class D rules would push cloud providers toward continuous, machine-readable assurance instead of one-time compliance packages. - The proposals affect providers pursuing federal business under the 20x program, where evidence quality and change management are becoming central to approval and oversight. - The comment windows close Nov. 19 for RFC-0036 and Nov. 17 for RFC-0035, giving providers a short runway to shape the next phase of the program.

What happened: - FedRAMP opened RFC-0036 on cloud-hosted Class D pilot requirements and ten new Key Security Indicators. - FedRAMP also opened RFC-0035 on proposed changes to cryptographic-module rules for 20x and Rev. 5 offerings. - The proposals were issued Oct. 21, 2026, and are still subject to public comment.

The details: - RFC-0036 would require Class D providers to use at least four automated methods to track Key Security Indicator status. - The same proposal would require machine-readable certification-package data. - RFC-0036 would generally move providers through Class C first before Class D qualification. - The draft would also limit certain third-party services that can handle federal customer data. - The proposal would require ongoing visibility into foreign ownership, control, or influence. - RFC-0035 would define a CMVP-validated module. - RFC-0035 would change one Class D expectation from MUST to SHOULD. - RFC-0035 would treat replacing a validated module with a non-validated module as a transformative change. - FedRAMP says RFC-0035 would not change agency obligations under FIPS 140-3. - FedRAMP also says RFC-0035 would not create post-quantum cryptography requirements. - RFC-0036 separately would require Class D providers to document the post-quantum status and transition target dates for digital key establishment and signatures used to protect federal customer data.

Between the lines: - The draft rules suggest FedRAMP wants evidence that stays current as systems, suppliers, cryptographic components, and ownership conditions change. - The proposals also imply that providers will need stronger internal mapping between services, cryptographic modules, validation status, ownership indicators, and agency notifications. - Lazarus Alliance framed the draft as an evidence-design exercise, not a documentation sprint, which reflects the operational burden the proposals could create. - Michael Peters, CEO and founder of Lazarus Alliance, said providers will need reliable evidence showing how cryptography, dependencies, ownership conditions, and material changes are governed over time.

What providers should do next: - Lazarus Alliance recommends that providers use the comment window to run a focused readiness exercise. - That exercise should map the proposed rules to the actual system boundary. - Providers should identify evidence owners and test data quality and collection frequency. - Providers should document exceptions and agency-specific decisions. - Providers should verify that significant-change procedures reach the right stakeholders. - Organizations should separate readiness advisory work from independent assessment activities so roles, evidence, and conclusions stay clear.

The bottom line: - FedRAMP’s Class D draft rules are shifting the conversation from static compliance artifacts to continuously defensible assurance, and providers that cannot trace evidence in real time may face a harder path to federal cloud work. - Lazarus Alliance said the RFCs remain proposals and may change after public comment.