FedRAMP 20x Phase 4: Class D Pilot Dates and the 7 December VDR Deadline

Between 9 September and 15 October 2026, FedRAMP opened four requests for comment that shape the next year of the program: RFC-0033 and RFC-0034 on 9 September, RFC-0035 on cryptographic module use on 14 October, and RFC-0036 with the Class D cloud-hosted pilot requirements on 15 October. In the same period FedRAMP published its FY26 review, which confirms that new Rev5 applications stop on 11 June 2027. For providers already certified, the date that matters most is closer: the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules become mandatory on 7 December 2026.

What's affected

Phase 4 and the Class D pilot (RFC-0033 and RFC-0036). RFC-0033 proposes three parallel tracks: a Class D pilot for cloud-hosted services, direct work with self-hosted Rev5 providers on self-hosted requirements, and work with assessors on how to assess them. Its pilot timeline:

• 18 November 2026: final pilot requirements published.
• 1 to 4 December 2026: application window. Applicants need a Class C certification compliant with the Consolidated Rules for 2026 (CR26) before 1 December.
• 7 to 18 December 2026: initial participant discussions.
• 17 February 2027: mandatory draft package submission.
• 17 March 2027: final package deadline.
• The pilot is capped at 10 participants.

RFC-0036 sets out the proposed Class D rules: 2 new definitions, changes to 6 rulesets and 10 new Key Security Indicators. Examples include verifying machine-based resources at least every 3 days, publishing historical activity as machine-readable JSON updated at least every 7 days, documenting post-quantum status for key establishment and signatures, and tracking foreign ownership, control or influence (FOCI) information for customers. Applicants need a full, non-pilot 20x Class C certification.

Cryptographic modules (RFC-0035). The proposed new rule CMU-CSO-TSC says providers "MUST treat changes from CMVP-validated modules to non-CMVP-validated modules as transformative changes" when those modules protect federal customer data. Updating a validated module through its own update stream is not such a change. The RFC also proposes moving Class D from MUST to SHOULD on using CMVP-validated modules, matching Class C. Under the CR26 deadlines table, the Cryptographic Module Use rules apply for obtaining and maintaining certification from 1 January 2027, with a grace period to 1 June 2027.

VDR and VER (already final). FedRAMP notice NTC-0014 says both rulesets become mandatory for all offerings obtaining or maintaining certification on 7 December 2026. Offerings that are not compliant can keep certification under a corrective action plan, with notice to all agencies, through 7 March 2027. After that, FedRAMP says certification is revoked for offerings not following the rules. The notice also states that legacy monthly vulnerability scanning is insufficient under CISA BOD 26-04, and that VER sets a default assumption that exploits are automatable unless evidence shows otherwise.

Does this apply to you?

• You hold any FedRAMP certification, Rev5 or 20x: the 7 December VDR and VER date applies to you. This is a requirement in the CR26 rules, not guidance.
• You hold a 20x Class C certification and want Class D: read RFC-0036 now. The application window is 1 to 4 December, and only 10 seats exist.
• You run a self-hosted or hybrid service: RFC-0033 Track 2 is where your rules will be written. They are not final.
• You use or plan to swap cryptographic libraries: RFC-0035 would make moving off a CMVP-validated module a transformative change. It is a proposal until FedRAMP finalizes it.
• You are on Rev5 without significant progress or a guaranteed sponsor: the FY26 review tells you to move to 20x now.

What to do now

1. By 31 October 2026: compare your vulnerability process to the VDR and VER rulesets line by line. If you still run monthly scans and a POA&M spreadsheet, you are behind.
2. By 13 November 2026: make sure you can show, per finding, whether it is internet-reachable and whether an exploit is likely automatable. VER assumes automatable unless you have evidence.
3. By 7 December 2026: VDR and VER compliance for obtaining or maintaining certification. If you will miss it, prepare the corrective action plan and agency notice FedRAMP describes.
4. By 1 December 2026: if pursuing Class D, have your CR26-compliant Class C certification in hand and apply between 1 and 4 December.
5. Before 1 January 2027: inventory every cryptographic module protecting federal customer data and record its CMVP status, so a library upgrade does not turn into an unplanned transformative change.
6. By 7 March 2027: end of the VDR and VER grace period.

Why it matters

FedRAMP's direction is clear from these documents: less paperwork and more machine-readable evidence produced on a short cycle. Every 3 days, every 7 days, JSON via API. Teams that still assemble evidence by hand once a month will struggle with the cadence, regardless of how good their controls are.

The VER default is the other shift. If you cannot show that a vulnerable component is unreachable or unexploitable in your service, FedRAMP's rules treat the worst case as true. Evidence about exploitability, including whether your code actually calls the vulnerable function, becomes part of the compliance record rather than an internal triage note.

Try it yourself

Take five open findings from your last scan. For each, write down two facts: is the affected service reachable from the internet, and does your code call the vulnerable function? Count how many you could answer with evidence instead of a guess. Safeguard's reachability analysis answers the second question by checking whether your code calls the vulnerable function.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• FedRAMP changelog
• FedRAMP RFC-0033: 20x Phase 4 Development Tracks for 20x Class D
• FedRAMP RFC-0035: Cryptographic Module Use Updates
• FedRAMP RFC-0036: 20x Class D Cloud-Hosted Pilot Requirements
• FedRAMP NTC-0014: FedRAMP Response to CISA BOD 26-04
• FedRAMP CR26: Rev5 Deadlines
• FedRAMP blog: From Foundation to Implementation (8 October 2026)