Planning for FedRAMP Class D? Here’s what to do before January 2027

Establishing the pathway to Class D

The two RFCs reveal a key requirement for CSPs seeking this level of assurance. Through FRC-CLD-PCD “Progressive Certification to Class D” the PMO has proposed that Class D certification (after the pilot) shall only be awarded to a CSP after successfully obtaining and maintaining a 20x Class C Certification without corrective action for 6 months. The rationale for this requirement has been noted within RFC-0036, citing the significant investment and commitment needed from the CSP, PMO and the individual agencies; the progressive level of assurance is seen as a softer path to spreading the investment for all parties involved, avoiding the issues and delays seen with the now legacy Rev5 High/Class D packages. 

The notes regarding this proposed rule also identify that current legacy Rev5 Class D CSPs will still be expected to move through this progressive Class C path.

The PMO has stipulated that any exceptions to this requirement will require a review by FedRAMP, with urgent critical need and a board approved prioritization being the minimum bar.

What does this mean for CSPs trying to approach the market at the highest level?

This novel idea of progressive assurance should be viewed as a sensible, risk-gated path that paves the way for both capturing market advantage and serving as a capability barometer measuring its maturity towards an even higher achievement.  Achieving Class C certification as soon as possible not only enables a CSP to achieve a successful listing in the FedRAMP marketplace but also initiates the 6-month vetting period once the pilot concludes. Practically, this means a Class C certified CSP can continue to monitor, develop and perfect the additional capabilities outlined within these RFCs, and position itself to achieve Class D in accelerated fashion while the pilot progresses through Q3 2027. 

The commonly misplaced notion that the highest level of certification fetches the most attention from marketplace buyers may be overturned by this well-crafted message from the PMO. Certifying 20x Class C by itself should serve as  a strong market differentiator that captures a large swathe of agency buyers' attention. However, the stringent expectations of no corrective actions for six months and implementing up to 10 new KSIs, with at least four automated methods for tracking each KSI (compared with two per KSI for Class C), pose a large technical and investment barrier. Evaluating the organization's appetite to upskill for Class D as early as possible helps leaders make critical business decisions sooner, meaning planning for Class C certification attainment by Q2 2027 is the best value proposition. Absent a compelling business case, full investment in achieving Class D certification is a potential waste of resources.

The shared responsibility model requires the use of Class C or Class D certified IaaS/PaaS for the underlying environment, with a risk-based Class B, C, or D Certified Third-Party Information Resources permitted in the CSP’s Minimum Assessment Scope (MAS). CSPs using current Rev5 Class D validated public cloud(s) can continue to take advantage of native capabilities to offload requirements, as transition paths for hyperscalers are finalized with this pilot.

Proposed agency participation for high assurance environments

A clear departure from the current Class A, Class B and Class C certification procedures, the PMO has proposed agency review of packages for Class D certifications, encouraging CSPs to consider providing additional assurance capabilities/metrics and support for directly integrating the results into agency GRC systems. The technical implementation requirements for direct agency consumption have been defined via;

• CDS-CSX-API “API Certification Data”
• VER-TFR-MRH “Historical Activity”
• SDR-CSX-KMT “Key Security Indicator Metrics”, 

fortifying the machine-readable concepts previously unveiled with FedRAMP 20x.

The PMO has also clarified that FOCI concerns are a matter of agency specific expectations and will not directly make any determinations through the framework. The approach instead has been centered around KSIs that require CSPs to identify and continuously maintain FOCI posture in accordance with agency specific determinations.

Updates on self-hosted and hybrid-hosted service provider requirements

Key objectives of the 20x Class D pilot program include not only the complete set of definitions for fully cloud-hosted services, but also definitions for self-hosted and hybrid-hosted offerings that were purposefully held back during the Class A, Class B and Class C certification finalization. The PMO plans to release Consolidated Rules for 2027 that will provide formal criteria for self-hosted and hybrid-hosted services, after fully considering existing industry standard certifications and the FedRAMP Rev5 requirements.

Your next steps toward FedRAMP Class D readiness

While the pilot's conclusion in early Q3 2027 will determine the final requirements, the signal from the PMO regarding the expectations is clear; a Class C certification is a recommended landing zone before a go/no-go decision towards Class D. Since the onus falls not only on CSPs but also on agencies to support Class D packages via technology enhancement, achieving Class C certification quickly becomes an immediate market capture move. Consolidated Rules for 2027 will be a much-anticipated release, with those CSPs already certified to Class C having a distinct advantage towards achieving Class D in its final form.