On September 9, 2026, FedRAMP opened two Requests for Comment that start Phase 4:
- RFC-0033 — 20x Phase 4 Development Tracks for 20x Class D
- RFC-0034 — Technical Advisory Group Changes
Both close October 9, 2026.
This is not a Marketplace listing day. It is the planning window for High. Class B and Class C pipelines opened August 31. Phase 4 is how FedRAMP takes 20x to Class D — the former High baseline — and how it starts writing rules for self-hosted and hybrid-hosted services that Phase 1–3 left behind.
Providers who want a seat in the Class D pilot have one hard gate: a CR26-compliant FedRAMP 20x Class C Certification before December 1, 2026.
What Phase 4 Actually Is
Phase 4 expands 20x in two directions at once: higher assurance, and non-cloud-native hosting.
FedRAMP is explicit. Class D is meant to supply assurance for workloads where a failure of confidentiality, integrity, or availability can cause catastrophic harm, including loss of life. The program expects finalized 20x Class D requirements to exceed legacy Rev5 Class D. It also expects few commercial services to fund that jump.
Three tracks run at the same time.
| Track | Who it is for | What FedRAMP wants |
|---|---|---|
| 1 — Class D cloud-hosted pilot | CSPs with a CR26-compliant 20x Class C by Dec 1, 2026 | Prove 20x can deliver Class D faster and cheaper than Rev5 High |
| 2 — Self-hosted / hybrid rules | Rev5 Class C or D providers that are primarily self-hosted or hybrid, with at least 15 agency uses | Reuse existing datacenter certifications instead of reinventing infrastructure controls |
| 3 — Assessor engagement | FedRAMP-recognized independent assessment services that assessed a Track 2 qualifier in the last 3 years | Write 20x assessment rules for physical infrastructure |
Pilot size is capped at 10 cloud-hosted participants. Phase 2 pilot status alone does not qualify. You need the full CR26 Class C certification.
Unlike Phases 1 and 2, agencies are in the room. FedRAMP wants at least three agency ATOs issued from Phase 4 packages during the pilot. RFC-0034 stands up a Technical Advisory Group so agency security staff can detail into FedRAMP and work those packages.
The Dates That Matter
Comment period first. Then the pilot calendar FedRAMP published with RFC-0033.
| Date | Milestone |
|---|---|
| September 9, 2026 | RFC-0033 and RFC-0034 open |
| October 9, 2026 | Both RFCs close |
| October 12–16, 2026 | Track 2 / Track 3 opt-in window for qualifying CSPs and assessors |
| October 14, 2026 | Full Class D pilot requirements RFC |
| November 13, 2026 | Apply for Class C before this date if you intend to notify FedRAMP of Phase 4 intent |
| November 18, 2026 | Final Class D pilot requirements published |
| December 1, 2026 | Class C certification must be in hand |
| December 1–4, 2026 | Phase 4 pilot application window |
| February 17, 2027 | Mandatory draft package |
| March 17, 2027 | Final pilot package |
| March 23, 2027 | Tentative FedRAMP Day / pilot close-out |
Final Phase 4 rules go into the Consolidated Rules for 2027, not a midstream rewrite of CR26.
What Class D Is Likely to Demand
RFC-0033 is still a proposal. The direction is not vague.
- Hold 20x Class C with no corrective action for six months before post-pilot Class D eligibility.
- Deploy cloud-hosted or hybrid Class D services on Class D certified IaaS/PaaS.
- Limit third-party information resources in the minimum assessment scope to Class B, C, or D certified services.
- Staff real agency support: package walkthroughs and feeds into agency GRC systems.
- New KSIs for assurance engineering, automation, availability, and a FOCI theme.
That last item is the strategic tell. Class D is not Moderate-plus-encryption. It is High plus continuous proof plus ownership scrutiny.
Do not treat Rev5 High as a substitute path you can finish at leisure. New Rev5 submissions end June 11, 2027. 20x Class D is being designed as the durable High path.
The Opportunity
Most CSPs will read “Phase 4 opened” and wait for the October 14 requirements RFC. The providers who make the pilot will not.
If you want Track 1: Class C is the product, not Class D. Lazarus Alliance is already taking native 20x Class B and Class C intake. A Class C package that is still in narrative Rev5 shape in October will not be CR26-certified by December 1.
If you already hold Rev5 Moderate or High: decide whether you are converting to 20x Class C now so Class D is reachable in 2027, or staying on Rev5 until that door closes.
If you run your own iron: Track 2 is the first serious 20x conversation about self-hosted and hybrid services. Qualifying providers get an inbox notice October 12. Respond by October 16.
If you are an assessor: Track 3 is how 20x assessment rules for physical infrastructure get written. Lazarus Alliance is an A2LA-accredited FedRAMP 3PAO. We will comment on both RFCs and engage the assessor track where we qualify.
Comments belong on the GitHub RFC threads or the FedRAMP form. General cheerleading is ignored. Targeted comments on hosting definitions, the six-month clean Class C bar, FOCI KSIs, and the 10-seat cap are what move the draft.
What CSPs Should Do This Week
- File comments on RFC-0033 and RFC-0034 before October 9.
- Confirm whether December 1 Class C is realistic. If it is not, stop planning for the pilot and plan for post-pilot Class D eligibility instead.
- Inventory inheritance. A Class C service on Class C IaaS cannot become Class D without a Class D platform underneath it.
- Map third-party services in scope. Uncertified or Class A-only dependencies will break a Class D boundary.
- Put OSCAL, KSIs, and automated validation on the critical path now. Class D will not accept a PDF conversion at the end.
- If you are self-hosted or hybrid and already Rev5 Class C or D with 15+ agency uses, watch the Security Inbox on October 12.
Position the Class C Package Now
Phase 4 is the High conversation. The work that unlocks it is Class C work that is already underway.
Lazarus Alliance, an A2LA-accredited FedRAMP 3PAO, is accepting native 20x Class B and Class C intake and advising CSPs on Phase 4 readiness, RFC comments, boundary design, and the Class D inheritance problem. Continuum GRC / A.ITAM is the working system for KSI mapping, OSCAL packages, and evidence that can survive a Class D review.
To open a Phase 4 readiness discussion, contact us or call +1-888-896-7580.