FedRAMP opens 20x Phase 4 for Class D and self-hosted paths

On September 9, 2026, FedRAMP opened RFC-0033, the Request for Comment that starts FedRAMP 20x Phase 4. Phase 4 is how the program plans to bring 20x to Class D (the former High baseline) and to write rules for self-hosted and hybrid-hosted services earlier phases left out. Companion RFC-0034 covers Technical Advisory Group changes. Both close October 9, 2026.

This is a planning window, not a Marketplace listing day. Full Class D pilot requirements follow in an RFC on October 14, 2026, with finals targeted for November 18, 2026.

What changed

Phase 4 runs three tracks at once:

1. Class D cloud-hosted pilot. Providers that want a seat need a Consolidated Rules for 2026 (CR26) compliant FedRAMP 20x Class C Certification before December 1, 2026. The pilot application window is December 1 to 4, 2026. FedRAMP caps the pilot at 10 participants. Draft packages are due February 17, 2027, and final packages March 17, 2027.
2. Self-hosted and hybrid-hosted rules. Qualifying Rev5 Class C or Class D providers that are primarily self-hosted or hybrid, with at least 15 agency uses, should get FedRAMP Security Inbox notices around October 12, 2026, with an October 16 opt-in deadline.
3. Assessor engagement. FedRAMP Recognized independent assessment services that assessed those providers can opt into a parallel track on the same October dates.

After the pilot, FedRAMP expects Class D eligibility to require six months of clean Class C performance, Class D IaaS or PaaS underneath cloud or hybrid offerings, tighter third-party component rules, and new Key Security Indicators, including a Foreign Ownership, Control, or Influence theme.

Class A through Class C 20x pipelines that already opened, the Rev5 sunset dates, and the December 7, 2026 Vulnerability Detection and Response mandate are unchanged.

What to do now

1. If you sell High-impact federal cloud, treat December 1, 2026 Class C certification as the Phase 4 gate, not the later Class D package dates.
2. Pilot hopefuls should finish Class C before December 1, and send a notice of intent to the FedRAMP Director after submitting if they apply before November 13, 2026.
3. Comment on RFC-0033 and RFC-0034 before October 9, 2026 if the Class D bar or self-hosted definitions affect your roadmap.
4. Self-hosted or hybrid providers that meet the Track 2 criteria should watch the Security Inbox the week of October 12, 2026.
5. Read the FedRAMP page for how the classes fit together, and follow FedRAMP on this site for the October requirements RFC and pilot outcomes.