FedRAMP 20x Class D: The Next Evolution of Continuous Security Assurance

FedRAMP has taken another major step toward modernizing federal cloud security.

On October 15, 2026, FedRAMP released RFC-0036, outlining proposed requirements for the FedRAMP 20x Class D Cloud-Hosted Pilot. This represents the next phase of FedRAMP 20x, introducing higher assurance expectations for cloud service providers (CSPs) supporting federal agencies.

The proposal includes 10 new Key Security Indicators (KSIs), expanded automation requirements, machine-readable certification data delivered through APIs, and additional considerations for foreign ownership, control, or influence (FOCI).

One of the most significant developments is the continued shift toward persistent, measurable security assurance. Class D providers would be expected to use at least four distinct automated methods to validate each KSI, reinforcing the move away from periodic compliance exercises toward continuously demonstrated security.

What This Means for Cloud Service Providers

FedRAMP 20x is changing how CSPs approach federal compliance. Security evidence must become more accessible, automation more comprehensive, and continuous monitoring more deeply integrated into everyday operations.

At InfusionPoints, this direction aligns with the approach we’ve taken through our XBU40 secure cloud platform, VNSOC360° security operations, and AuditShield automated security validation capabilities.

As FedRAMP continues to evolve, our focus remains on helping CSPs build secure environments where compliance is not simply documented but continuously demonstrated.

The future of FedRAMP is not just about achieving certification. It’s about continuously proving security.

RFC-0036 is currently open for public feedback through November 19, 2026.

Review the proposed requirements and participate in the discussion ↗