FedRAMP's October 20x update: five Class A certifications so far, and a full Class C is the only way into the Class D pilot

FedRAMP has certified five Class A services under 20x and none yet at Class B or C. Only providers with a full Class C certification under the 2026 rules can join the Class D pilot, and request for comment RFC-0033 says they must hold one before December 1, 2026.

By FedXchange · November 6, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its monthly 20x Community Update on October 14, 2026, and posted the video on October 15. FedRAMP 20x is the program's newer certification path, built on automated, machine-readable evidence. The meeting covered four things: how many providers have applied, small changes to the Consolidated Rules for 2026 (CR26), what reviewers have learned, and the Phase 4 pilot for Class D, the highest certification class.

In short. FedRAMP has tracked 40 20x submissions and has certified five, all at Class A. No Class B or Class C service is certified yet. Only providers that hold a full CR26 Class C certification can join the Class D pilot. RFC-0033, a FedRAMP request for comment (RFC), says a provider must hold that certification before December 1, 2026. Two new RFCs are open for comment: RFC-0035 on cryptographic modules, until November 17, and RFC-0036 on the Class D pilot rules, until November 19. Agencies should note that FedRAMP stops taking new applications for its older Rev5 path on June 11, 2027.

The road into the 20x Class D pilot

Target dates from RFC-0033, which says they assume no unexpected problems. Source: FedRAMP RFC-0033 and the RFC list on fedramp.gov.

Read the steps as text

October 15, 2026. FedRAMP posts RFC-0036 with the proposed Class D pilot rules. Comments close November 19.
Before November 13. A provider that applies for Class C before this date and wants to join the pilot sends the FedRAMP Director a notice of intent after applying.
November 18. Target date to publish the final Class D pilot requirements.
December 1. A provider must hold a CR26-compliant 20x Class C certification before this date to apply.
December 1 to 4. The pilot application window.
December 7 to 18. Initial discussions with participants.
February 17, 2027. Each participant must submit a draft package for a progress review.
March 17, 2027. Deadline for the final pilot package.

Where do 20x submissions stand?

A FedRAMP cloud security engineer gave the numbers in the video. FedRAMP has tracked 40 submissions: 28 at Class A, 10 at Class C, and 2 at Class B.

FedRAMP 20x submissions by status, October 14, 2026

Source: FedRAMP 20x Community Update video, October 14, 2026.

Show the numbers

	Submissions
Class A certified	5
Class A under review	3
Class A in intake	14
Class A not approved	6
Classes B and C under review	2
Classes B and C in intake	8
Classes B and C declined	2

From first submission to final certification, a review takes 37.2 calendar days on average, counting waits and weekends. The shortest was 20 days and the longest 54. Active review by FedRAMP staff averages 10 business days. A FedRAMP leader said the 37-day figure covers all classes and is likely to rise for a while, because many 20x submissions are new kinds of services or arrive incomplete.

All five certified Class A services used a System and Organization Controls (SOC) 2 Type 2 report. Rev5 is FedRAMP's older path, based on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog. No provider has yet submitted a Class A package based on a Rev5 readiness assessment report.

Who can join the Class D pilot?

Only a provider with a full Class C certification under CR26. A FedRAMP leader said in the video that "that means a full class C certification." A Class C certification from the earlier 20x pilot does not count, and earlier pilot participants must apply like anyone else. The leader also said the pilot was expected to start around December, and that FedRAMP could delay it a few months if no provider is ready.

After the pilot, the rule is stricter. RFC-0033 says a service must hold a 20x Class C certification without corrective action for 6 months before it can apply for Class D. FedRAMP gave its reason in the video: Class D takes much more government effort, so it wants to see a provider succeed at Class C first. The 6-month wait applies only to Class C before Class D. It does not apply between Classes A, B, and C.

RFC-0036 proposes the pilot rules. It adds 10 new Key Security Indicators (KSIs), the measured security outcomes 20x uses in place of control narratives. Among the proposals:

Class D providers must share the machine-readable parts of their certification package through an application programming interface (API), so reviewers can pull the latest data at any time.
Providers must document the post-quantum status of the key establishment and digital signature algorithms that protect federal customer data, and a target date to move to post-quantum or hybrid algorithms where available.
Providers should decide when the likelihood that a detected vulnerability was exploited is high enough to start a forensic search for indicators of compromise, then do that search.
Providers must show that they keep watching for foreign ownership, control, or influence (FOCI). FedRAMP said it will not collect or rule on FOCI details itself.

The RFC also proposes that Class D providers limit the likely handling of federal customer data to third-party services in a FedRAMP Class B, C, D, or G Certified offering. In the video, a FedRAMP leader described this as a "must". The RFC text says "should".

What changed in the 2026 rules?

FedRAMP described three small changes, recorded in its rules changelog for October 5 and October 8, 2026.

A new N0 rating. Rule VER-EVA-EPA asks providers to estimate the likely potential agency impact of exploiting a vulnerability. It now has an N0 rating, for exploitation that is extremely unlikely to affect agencies. The word "likely" was added so providers need not rate unlikely scenarios. Providers content with N1 (minimal effects) need not change anything.
One rule for keeping security metrics. FedRAMP removed a duplicate rule and kept SDR-CSX-KMT in the Security Decision Record (SDR) rules. A note says new applicants need the tools and a commitment to keep metrics, not 6 months of past data. A FedRAMP leader said in the video that this "is not something you have to sit and spin for 6 months before you can apply."
Web-ready data. Public JSON (JavaScript Object Notation) data must work in web apps, and the logo link must point to a properly named image file.

FedRAMP asked providers to check the rules for changes once or twice a week. Its changelog says it will move to a monthly release cadence after November 2, 2026.

Does FedRAMP still require validated cryptographic modules?

RFC-0035 would change one rule at Class D. Class D providers would move from "must" to "should" use modules validated by the NIST Cryptographic Module Validation Program (CMVP), the same as Class C. A new rule would treat replacing a validated module with an unvalidated one as a transformative change at Classes B, C, and D. The RFC applies to both 20x and Rev5. It does not require current services to change anything. It also does not change agency duties under Federal Information Processing Standard (FIPS) 140-3.

On a provider with a valid technical reason to use another module, a FedRAMP leader said in the video: "write it down, make it clear and then FedRAMP's going to be okay with it. The question is whether or not your customers will be okay with it."

What should agencies and providers do now?

Providers aiming for Class D: finish a full CR26 Class C certification first. Read RFC-0036 and comment by November 19.
All providers: submit complete, concise packages. Make the trust center easy to open, answer FedRAMP within a day or two, and use FedRAMP's self-check guide and JSON schema validator. Reviewers named missing machine-readable or human-readable formats, a missing SDR, and an old SOC 2 report without a bridge letter as reasons packages failed.
Providers using compliance platforms: a FedRAMP leader said in the video that "you are 100% fully and absolutely responsible" for what you attest. A tool's checklist does not move that duty.
Agencies: do not rely on the Marketplace's agency-use data. A FedRAMP leader said it is not accurate, because agencies largely stopped sending FedRAMP their authority to operate (ATO) letters. For a new provider, a Rev5 sponsorship now rarely makes sense. FedRAMP takes no new Rev5 applications from June 11, 2027.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.