RFC-0036 FedRAMP 20x Class D Cloud-Hosted Pilot Requirements

Summary & Motivation

The FedRAMP 20x Cloud-Hosted Class D Pilot will explore the impact and implementation of the highest assurance level of FedRAMP Certification for cloud-hosted services. This RFC proposes specific changes to a variety of rulesets and key security indicators to test during the Phase 4 pilot.

This RFC includes the following:

• 2 new definitions
• Miscellaneous updates to 6 different rulesets
• 10 new Key Security Indicators

Additional rules and Key Security Indicators may be added during or after the Phase 4 pilot, and the existing rules and indicators are likely to change based on direct feedback during the pilot. FedRAMP understands that it would be convenient to know exactly what the rules are likely to be a year in advance, but that is not a realistic approach to developing a new process that is responsive to real world impacts.

The addition of Foreign Ownership, Control or Influence (FOCI) information:

FedRAMP seeks to drive a balance between the amount of assurance related to FOCI that agencies might expect and the varying amounts of assurance related to FOCI that different cloud service providers may invest in. The goal is to provide basis rules and indicators that a cloud service provider can follow to provide an appropriate level of assurance, based on their own business strategy, in a fashion that can be shared with all potential agency customers. FedRAMP FOCI practices do not replace agency-specific needs or determinations, but should allow cloud service providers that implement them to save time and effort during an agency review.

FedRAMP will make no determinations on FOCI itself, only confirm whether cloud service providers adequately demonstrate that they persistently review the necessary indicators to understand FOCI and their business.

Feedback Requested

This RFC is intended specifically for the Phase 4 Cloud-Hosted pilot. FedRAMP is looking for feedback on the clarity, applicability, reasonability, and achievability of the proposed rules and Key Security Indicators for companies who wish to meet the highest levels of assurance for federal customers.

This RFC does not address Self-Hosted or Hybrid-Hosted rules or requirements as those are not part of the Phase 4 pilot.

New Definitions

FRD-FOR: Foreign Ownership, Control, Or Influence (FOCI)

A condition that occurs when a foreign entity has the power to direct or influence the management or operations of a cloud service offering used or relied upon by agencies. The full extent of the definition of FOCI includes any federal definition or regulation that defines the extent of possible foreign ownership, control, or influence as it might apply to a cloud service offering.

FRD-FPS: Foreign Person

Has the meaning given in 31 CFR 800.224, that is: “(1) Any foreign national, foreign government, or foreign entity; or (2) Any entity over which control is exercised or exercisable by a foreign national, foreign government, or foreign entity.”

Note: Reference URL

Miscellaneous Requirements

Please note that this RFC does not reproduce existing Class D rules that will apply to FedRAMP 20x in the Consolidated Rules for 2026; only new or modified rules are added. Participants are encouraged to review all existing Class D rules, of which there are many, for context while reviewing these updated requirements for FedRAMP 20x.

This section contains individual rules that are new or modified from existing rulesets.

Vulnerability Detection and Response

VDR-TFR-MVX Persistent Machine Verification and Validation for 20x

Providers with 20x Class D Certification MUST verify and validate the status of machine-based information resources at least once every 3 days.

Note: This matches the current Class C expectation for this rule.

Vulnerability Evaluation and Reporting

VER-EVA-IOC Indicators of Compromise

Providers with 20x Class D Certifications SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine when the likelihood of exploitation is high enough to initiate forensic activities such as searching for indicators of compromise; then do so.

Note: This is an entirely new rule. It may also be ported to Rev5 in CR27.

VER-TFR-MRH Historical Activity

Providers with Class 20x D Certifications MUST make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 7 days.

Note: This proposes a change from SHOULD to a MUST for 20x Class D.

Security Decision Record

SDR-CSX-KMT Key Security Indicator Metrics

Providers with 20x Class D Certifications MUST also include historical metrics in their Security Decision Record, supplying at least the following information for each applicable Key Security Indicator:

1. Summary of each metric over the past 30 days
2. Summary of metric up to the past year (where available)
3. Metric data (including status of persistent validation) every 4 hours up to the past year (where available)

Note: This should be supplied as a supplemental to the main Security Decision Record via API - see CDS-CSX-API (API Certification Date).

Certification Data Sharing

CDS-CSX-API API Certification Data

Providers with 20x Class D Certifications MUST responsibly supply all machine-readable parts of the FedRAMP Certification Package via web-compatible Application Programming Interface (API).

Note: This is a NEW rule for 20x Class D to increase the quality of assurance commensurate with the expectations for Class D.

Cryptographic Module Use

CMU-CSO-PQS Post-Quantum Cryptography Status

Providers with 20x Class D Certifications MUST document the post-quantum cryptography status of digital key establishment and digital signatures used to protect federal customer data, also adding at least the following information:

1. Whether each algorithm is Post-Quantum Cryptography, part of a hybrid implementation with post-quantum cryptography, or neither
2. The target date to transition it to post-quantum cryptography or a hybrid implementation (if available and applicable)

Note: This is a NEW rule for the Phase 4 pilot and the Consolidated Rules for 2027 and is therefore not included in RFC-0035 Cryptographic Module Use Rules Updates.

FedRAMP Certification for 20x Class D

(Note: This section includes proposed formal language for some rules that were mentioned in RFC-0033, and the proposed language was adjusted based on feedback from that RFC)

FRC-FRA-FOD FOCI Determinations are Agency Specific

FedRAMP MUST NOT request details of the foreign ownership, control, or influence of providers and will not make determinations about whether a provider’s foreign ownership, control, or influence is acceptable.

Note: Agencies determine whether a provider’s foreign ownership, control, or influence is acceptable for their use. FedRAMP verifies only that providers know and track foreign ownership, control, or influence. This rule makes it clear that FedRAMP does not intend to collect sensitive business information but does expect cloud service providers to be able to supply that information when required by their customers per a contract with them.

FRC-CLD-PCD Progressive Certification to Class D

Providers seeking a FedRAMP 20x Class D Certification MUST maintain a 20x Class C Certification without corrective action for at least 6 months OR receive a special exemption from FedRAMP to apply directly for a 20x Class D Certification due to an urgent critical need; such exemptions may include cloud services prioritized by the FedRAMP Board and limited pilots.

Notes:

• For the purposes of the FedRAMP 20x Phase 4 Pilot, a full non-pilot 20x Class C Certification is necessary to qualify for participation but six months without corrective action is not required.
• FedRAMP is a government program that is not funded by fees or services. Program certification for Class D is very complicated and requires considerable investment and commitment from FedRAMP - traditional sponsorship for Class D (High) often took many years. This breaks up investment and review by expecting a cloud service to demonstrate a progressive level of assurance over time instead of starting at the highest level. Any cloud service provider seeking a 20x Class D Certification can start at 20x Class C, then once this review is completed and they have demonstrated clear understanding of the requirements they can apply for a 20x Class D with additional support from the government with less risk to the taxpayer.
• No one with a Rev5 Class D will be expected to give up their Class D Certification, but transitions from Rev5 Class D will still be expected to move through 20x Class C first (we anticipate most Rev5 Class D offerings will seek to maintain their Rev5 Class D even after obtaining a 20x Class D).

FRC-CLD-CCH Certified Cloud Hosting

Providers seeking a FedRAMP 20x Class D Certification MUST be deployed on a FedRAMP Class C or FedRAMP Class D Certified Infrastructure-as-a-Service/Platform-as-a-Service offering; OR meet all applicable FedRAMP 20x Class D Self-Hosted or Hybrid-Hosted rules.

Note: This is a NEW rule that clarifies a gap in the current rules. Self-Hosted and Hybrid-Hosted rules do not exist yet; they will be developed during Phase 4 separately.

FRC-CLD-CTP Certified Third-Party Services

Providers seeking a FedRAMP 20x Class D Certification SHOULD limit the likely handling of federal customer data within the cloud service offering to third-party information resources that are included in a FedRAMP Class B, Class C, Class D, or Class G Certified offering.

Note: This is a NEW rule intended to ensure that the full lifecycle of federal customer data can be assessed for risk by agencies.

Key Security Indicators

FedRAMP has many rules that include specific assurance expectations for 20x (and Rev5) Class D compared to other FedRAMP Certification Classes. Key Security Indicators go beyond assurance to demonstrate that the cloud service provider is maintaining and tracking critical security information over time. FedRAMP 20x Class D providers will need to use at least 4 different automated methods to track Key Security Indicator status and are encouraged to go well beyond this. FedRAMP 20x Class D is intended to be competitive, such that providers who invest in additional automation, greater assurance, and high speed response and communication will consistently outperform providers that only seek to meet the minimal bar - though efficient providers at the minimum bar may compete on price or specific use cases.

In addition to all existing Key Security Indicators, FedRAMP proposes adding the following new Key Security Indicators specifically for FedRAMP 20x Class D based on the additional security capabilities expected from a High baseline (note that many automation capabilities are already addressed):

KSI-CMT-TNP Testing in Non-Production Environments

Planned changes are persistently verified and validated in simulated or non-production environments before production environments.

Related Controls: CM-4(1)

KSI-IAM-MST Monitoring Suitability

Privileged and high risk information resources have their access, privileges, suitability, and activities persistently reviewed and evaluated.

Note: This includes personnel, funds, and tech such as AI agents/etc. where access, privileges, suitability, and activity review is appropriate.

Related Controls: SI-4(19), SI-4(20)

KSI-IAM-MPI Managing Personnel Identities

The background and identity of personnel is persistently verified and validated, based on their privileges and assigned roles.

Related Controls: IA-12(4), SI-4(19)

KSI-RPL-MCA Maintaining Cryptographic Access

The ability to make critical information available in the event of cryptographic key loss or failure is persistently reviewed.

Related Controls: SC-12(1)

KSI-SVC-IED Inspecting Encrypted Data

Encrypted data is appropriately and responsibly inspected during transmission for malicious content and compliance with organizational data policies.

Related Controls: SI-4(10)

KSI-SVC-UAS Using Automated Security

Processes critical to the security of the system are supported by automated tools to ensure compliance and consistency.

Related Controls: AU-6(1), AU-7(1), CM-3(1), CM-5(1), CM-6(1), CM-8(2), IR-2(2), IR-5(1), PS-4(2), SI-2(2), SI-4(12), SI-5(1), SI-7(2), SI-7(5)

KSI-PIY-DFC Detecting FOCI Changes

Changes in foreign ownership, control, or influence are detected and appropriate actions are taken.

Note: Sensitive details of such changes or actions should not be included in Key Security Indicator metrics.

KSI-PIY-RFP Reviewing Foreign Persons

Foreign persons able to direct or decide matters affecting the cloud service offering are persistently reviewed.

Note: Sensitive details of such persons should not be included in Key Security Indicator metrics.

KSI-PIY-RFB Reviewing Foreign Businesses

Foreign business relationships that support the cloud service offering are persistently reviewed for ongoing risks.

Note: Sensitive details of such businesses should not be included in Key Security Indicator metrics.

KSI-PIY-MFD Maintaining FOCI Determinations or Mitigations

Foreign ownership, control, or influence determinations and/or mitigation agreements, issued by U.S. government agencies covering the entity that operates the cloud service offering, are persistently reviewed and maintained.

Note: Sensitive details of such determinations or agreements should not be included in Key Security Indicator metrics.