FedRAMP Class D Proposals Put Continuous Evidence and Cryptographic Decisions at the Center of Cloud Assurance

Lazarus Alliance urges cloud providers to treat the open pilot rules as an evidence-design exercise, not a documentation sprint.

SCOTTSDALE, AZ, UNITED STATES, October 21, 2026 /EINPresswire.com/ — FedRAMP has opened two requests for comment that would shape the next phase of its 20x program for high-assurance cloud services. RFC-0036 proposes cloud-hosted Class D pilot requirements and ten new Key Security Indicators, while RFC-0035 proposes changes to the program’s cryptographic-module rules for 20x and Rev. 5 offerings. The comment periods are scheduled to close November 19 and November 17, respectively.

For cloud service providers pursuing federal business, the proposals make one point especially clear: high assurance depends on evidence that remains current as systems, suppliers, cryptographic components, ownership conditions, and operating risks change. RFC-0036 would require Class D providers to use at least four automated methods to track Key Security Indicator status. It also proposes machine-readable certification-package data, progressive qualification through Class C in most circumstances, limits around third-party services that may handle federal customer data, and ongoing visibility into foreign ownership, control, or influence.

The companion cryptographic proposal is equally important for governance. RFC-0035 would define a CMVP-validated module, change one Class D expectation from MUST to SHOULD, and treat replacement of a validated module with a non-validated module as a transformative change. FedRAMP states that the proposal would not alter agency obligations under FIPS 140-3 and would not establish post-quantum cryptography requirements. RFC-0036 separately proposes that Class D providers document the post-quantum status and transition target dates for digital key establishment and signatures used to protect federal customer data.

Providers should therefore examine whether their evidence architecture can answer practical questions without a last-minute reconstruction: Which services use which cryptographic modules? Which validations are active? What changed, who approved it, and which agency customers were notified? Where can federal data move through third-party resources? Can ownership and control indicators be reviewed over time? Can automated evidence be reproduced and traced to an accountable control owner?

Lazarus Alliance recommends that providers use the comment window to run a focused readiness exercise. That exercise should map the proposed rules to the actual system boundary, identify evidence owners, test data quality and collection frequency, document exceptions and agency-specific decisions, and verify that significant-change procedures reach the right stakeholders. Organizations should also distinguish between readiness advisory work and independent assessment activities so that roles, evidence, and conclusions remain clear.

“FedRAMP’s Class D proposals move the conversation from static documentation toward continuously defensible assurance. Providers will need more than a control narrative; they will need reliable evidence showing how cryptography, dependencies, ownership conditions, and material changes are governed over time. The right preparation now is to test whether those records are accurate, repeatable, and usable by agency decision-makers.” — Michael Peters, CEO & Founder, Lazarus Alliance

Lazarus Alliance supports organizations with federal cloud security readiness, control and evidence assessment, risk management, governance, and authorized independent assessment services. The firm does not determine FedRAMP policy or guarantee certification outcomes. The RFCs remain proposals and may change after public comment.

ABOUT LAZARUS ALLIANCE

Lazarus Alliance is a veteran-owned global provider of Proactive Cybersecurity^®, specializing in cybersecurity audit and compliance, risk assessment and management, privacy audit and compliance, vulnerability and penetration testing, and IT policies and governance. Founded in 2000, the firm helps organizations attain, maintain, and demonstrate information security and compliance excellence across complex regulatory environments.

Lazarus Alliance is an authorized CMMC Third-Party Assessment Organization (C3PAO), an A2LA-accredited FedRAMP Third-Party Assessment Organization (3PAO), and a PCI DSS Qualified Security Assessor (QSA). Headquartered in Scottsdale, Arizona, Lazarus Alliance serves organizations ranging from startups to multinational enterprises with cybersecurity, privacy, risk, governance, and compliance expertise.

Michael Peters
Lazarus Alliance, Inc.
+1 8888967580
Visit us on social media:
LinkedIn
YouTube
X

About Lazarus Alliance

Media gallery