FedRAMP Class D is not simply “FedRAMP High with a faster checklist.” The strategic shift is that high-assurance cloud authorization is moving toward machine-readable evidence, repeatable validation, and continuous risk signals that can withstand scrutiny from federal agencies, mission owners, and assessors. For cloud service providers supporting sensitive federal workloads, the critical question is no longer whether a control is documented; it is whether the evidence proves the control is implemented, operating, monitored, and resilient under adversarial conditions.
FedRAMP has reported that FedRAMP 20x is moving from concept into an operating model, including 26 FedRAMP 20x certifications among 92 new FedRAMP certifications in FY26, and FedRAMP has stated that it will stop processing legacy Rev5 certification applications on June 11, 2027, according to FedRAMP, From Foundation to Implementation. The Class D discussion raises the stakes further: FedRAMP published RFC-0036 for FedRAMP 20x Class D cloud-hosted pilot requirements on October 15, 2026, with public comments open until November 19, 2026, and the RFC proposes 10 new Key Security Indicators for the highest-assurance FedRAMP 20x class, according to the FedRAMP Community RFC-0036 discussion.
For Lazarus Alliance clients, the takeaway is direct: FedRAMP Class D readiness should be treated as a high-assurance cloud risk management program, not a paperwork sprint. The ten Key Security Indicator areas below provide an audit-oriented operating model for preparing sensitive workloads for Class D expectations while preserving alignment with NIST 800-53 High, FedRAMP, GovRAMP, CJIS, CMMC, DFARS NIST 800-171, SOC 2, PCI DSS, HIPAA, IRS 1075, ISO 27001, C5, and the Lazarus Alliance Data Management Framework.








