FedRAMP proposes looser crypto rule for Class D and asks about FOCI

FedRAMP proposes looser crypto rule for Class D and asks about FOCI

15 October 2026: FedRAMP, the US government's cloud certification programme, has opened two requests for comment that change what its highest assurance level, Class D, asks of cloud providers. RFC-0035, open until 17 November 2026, would relax the requirement to use only NIST-validated cryptographic modules, and RFC-0036, open until 19 November, sets the rules for a Class D pilot that adds indicators on foreign ownership, control or influence (FOCI).

Not yet independently verified. Both are requests for comment, not adopted rules; FedRAMP says the pilot rules are likely to change after feedback. We will update this when it can be confirmed, and remove this note.

The cryptography change

Today a Class D provider must use modules validated under NIST's Cryptographic Module Validation Program to protect federal data. RFC-0035 changes that rule from MUST to SHOULD, matching Class C, and defines a "CMVP-validated module" as one with an active validation or an update stream of one. FedRAMP argues that forcing Class D services to use only validated modules can make providers run separate cryptography for government customers that costs more, lags behind commercial security updates and performs worse.

The proposal adds a safeguard: for Classes B, C and D, replacing a validated module with a non-validated one becomes a "transformative change" that agencies must be told about. Updating a module through its update stream does not count, and neither does adding a non-validated algorithm alongside a validated one, as in a hybrid scheme. Providers must still document which modules protect federal data, should default agency tenants to validated modules where available, and need do nothing differently if they already comply. The RFC does not change agencies' own FIPS 140-3 obligations or set post-quantum requirements.

The Class D pilot and foreign influence

RFC-0036 covers the Phase 4 pilot for cloud-hosted Class D services under FedRAMP 20x, its automation-first process; self-hosted and hybrid services are out of scope. Besides new definitions and changes to six rulesets, it adds ten key security indicators, including FOCI. FedRAMP stresses it "will make no determinations on FOCI itself", only check that providers keep reviewing the indicators. Among the new rules, providers must verify the status of machine-based resources at least every three days, publish recent vulnerability detection and response activity as JSON for automated retrieval, updated at least weekly, keep up to a year of metric history in four-hour steps, and supply all machine-readable parts of the certification package through an API.

Who should comment

Cloud providers pursuing high-assurance federal work, their third-party assessors and agency security teams are the obvious respondents. FedRAMP says the pilot rules "are likely to change based on direct feedback", so detailed comments on cost and feasibility, especially for the three-day validation and API requirements, are the way to shape them.

Sources

• FedRAMP: RFC-0035, Cryptographic Module Use rules updates, 14 October 2026
• FedRAMP: RFC-0036, 20x Class D cloud-hosted pilot requirements, 15 October 2026
• FedRAMP: requests for comment (read 2026-10-20), 20 October 2026