Questions / Answer
FedRAMP Wants Comment on Class D Pilot Rules and Crypto Changes
If you sell cloud software to federal agencies at the highest assurance level, two new FedRAMP proposals affect you. Both are open for public comment right now.
What did FedRAMP open?
FedRAMP is the Federal Risk and Authorization Management Program. It sets the security bar cloud providers must clear before agencies buy their products.
On October 14, FedRAMP opened a request for comment, called an RFC, on cryptographic module rules. That is RFC-0035. On October 15, it opened RFC-0036 on Class D pilot rules for Phase 4. Comments close November 17 for RFC-0035 and November 19 for RFC-0036.
Class D is the highest assurance level in FedRAMP 20x. It is the successor to the old High impact level. It covers the most sensitive federal workloads.
What changes for cryptography?
RFC-0035 rewrites the cryptographic module rules for both 20x and the older Rev5 path. Three moves matter.
First, Class D would drop from MUST to SHOULD on using CMVP-validated modules. That matches Class C today. CMVP is the NIST Cryptographic Module Validation Program. It tests that encryption modules work as claimed.
Second, the RFC adds a new transformative-change rule. Replacing a validated module with a non-validated one would count as a transformative change. It would apply to Class B, Class C, and Class D. Agencies would get timely warning before it happens.
Third, the RFC does not change agency obligations under FIPS 140-3. FIPS 140-3 is Federal Information Processing Standard 140-3. It still binds agencies where they rely on cryptography.
The stated reason is practical. Requiring only validated modules can force separate government-only cryptography that costs more and lags commercial updates. Providers could then integrate post-quantum cryptography where agencies ask for it.
What changes for Class D?
RFC-0036 proposes the rules for the Phase 4 cloud-hosted Class D pilot. Four of its ideas stand out.
First, certification becomes progressive. A provider would hold a Class C certification for six months without corrective action before applying for Class D. Pilot participants need Class C but skip the six-month wait.
Second, providers must use at least four automated methods to track Key Security Indicators. Indicators are the metrics that show security status over time. Ten new indicators are proposed for Class D.
Third, the certification package goes machine-readable. Class D providers must expose the machine-readable parts through a web API. The Security Decision Record must add 30-day and 12-month metric history, refreshed every four hours.
Fourth, providers must document the post-quantum status of key establishment and digital signatures that protect federal customer data. For each algorithm, they must state whether it is post-quantum, hybrid, or neither, plus a target date to transition.
Two more proposals round it out. FedRAMP adds formal definitions for Foreign Ownership, Control, or Influence and Foreign Person. FedRAMP itself makes no acceptability decisions on ownership. It only verifies that providers keep tracking their status. Agencies still decide what is acceptable. Third-party services that may handle federal customer data should sit inside a FedRAMP-certified offering.
Do you need Class D?
Class D is the top tier. It suits the most sensitive agency workloads. FedRAMP designed it as a step above Class C.
Defense contractors have a simpler test. DFARS clause 252.204-7012 requires a FedRAMP Moderate equivalent for covered defense information in the cloud. DFARS is the Defense Federal Acquisition Regulation Supplement. Class C is the 20x successor to Moderate. Unless your buyers handle the most sensitive data, Class C answers the requirement.
What should you do before the windows close?
FedRAMP asks specifically for feedback on clarity, applicability, reasonability, and achievability. If any rule is vague or unworkable, the comment window is the time to say so. Comments close November 17 for RFC-0035 and November 19 for RFC-0036.
Providers should do three things now. First, map the crypto rules to your module inventory and flag where you lack CMVP validation. Second, check your automation against the four-method minimum for indicator tracking. Third, confirm your Class C timeline if Class D is on your roadmap.
Buyers should ask one question of each vendor. Do you plan to pursue Class D, or will you stay at Class C? Put the answer in your vendor review file.
Sources
- RFC-0036: FedRAMP 20x Class D Cloud-Hosted Pilot Requirements
- RFC-0035: Cryptographic Module Use Rules Updates
- FedRAMP Requests for Comment, with open and closing dates
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
Next step
Mapping which FedRAMP class your cloud stack supports? Start by collecting evidence of your Azure configuration against the right controls.