# FedRAMP Proposes Class D Cloud Rules

FedRAMP has opened RFC-0036 and RFC-0035 for public comment on proposed Phase 4 20x Class D cloud-assurance and cryptographic rules. The proposals cover post-quantum cryptography, foreign ownership, control or influence (FOCI), vulnerability reporting, automated security indicators, third-party data handling, significant changes, and Class C eligibility. Comments are due **November 17, 2026, for RFC-0035** and **November 19, 2026, for RFC-0036**; these are proposed rules, not current mandatory requirements.

- Cloud providers pursuing federal business can assess whether they can maintain traceable, automated evidence for security indicators, cryptographic modules, third-party data handling, ownership conditions, and significant changes.
- Providers should review the two RFCs and submit comments by the relevant deadline if the proposed controls or eligibility provisions affect their federal cloud offerings.
- The proposals may shape a faster alternative to FedRAMP’s legacy Rev5 pathway, making the Class D pilot’s assurance model relevant to providers planning federal market entry or product changes.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cloud Services, Cybersecurity
**Published:** October 21, 2026

### Government Entities
- Federal Risk and Authorization Management Program (FedRAMP)

### Vendors
- Vanta (FedRAMP 20x Class C certified provider)
- Lazarus Alliance (FedRAMP Third-Party Assessment Organization (3PAO) providing readiness and assessment services)

### Sources
- [FedRAMP Seeks Input on Proposed 20x Class D Pilot Rules](https://www.executivegov.com/articles/fedramp-20x-class-d-pilot-rules-pqc-foci-input-request) - ExecutiveGov
- [FedRAMP Class D Proposals Put Continuous Evidence and Cryptographic Decisions at the Center of Cloud Assurance - EIN Presswire](https://www.einnews.com/pr_news/951257471/fedramp-class-d-proposals-put-continuous-evidence-and-cryptographic-decisions-at-the-center-of-cloud-assurance) - EIN News