A cloud service can look simple on an architecture diagram while hiding a complicated chain of infrastructure, vendors and responsibilities.
For contractors supporting federal programs, those dependencies can affect security responsibilities, vendor coordination, documentation, operating costs and modernization decisions. That makes the latest FedRAMP 20x program development worth watching.
On September 9, 2026, FedRAMP opened RFC-0033, proposing Phase 4 development tracks for 20x Class D and services that are self hosted or hybrid hosted. The proposal introduces initial assurance expectations and development milestones, while detailed requirements will follow through the Phase 4 process.
For IT leaders, the immediate priority is practical: understand the cloud environment you operate today and identify dependencies that could matter as FedRAMP 20x expands.
What FedRAMP 20x Phase 4 Proposes
RFC-0033 focuses Phase 4 on extending FedRAMP 20x to Class D and services that are not primarily cloud hosted. The proposal includes three tracks: a Class D pilot for cloud hosted services, development of requirements for self hosted and hybrid hosted services and engagement with independent assessors to develop assessment approaches for those environments. FedRAMP also proposes formal definitions for cloud hosted, self hosted and hybrid hosted services. That distinction matters because infrastructure responsibilities can change depending on who operates the physical environment.
The proposed Class D model would introduce significantly higher assurance expectations than Class C. FedRAMP identifies areas including assurance engineering, automation, availability and Foreign Ownership, Control or Influence. Cloud hosted and hybrid hosted Class D services would also be expected to operate on Class D certified infrastructure or platforms. These are development proposals, so contractors should use them for planning rather than treat them as final universal requirements.
Start With the Hosting Model
A contractor may know which cloud product it uses without knowing exactly how the supporting infrastructure is arranged.
Consider a service with workloads in a commercial IaaS platform, dedicated equipment in a provider facility and customer-controlled systems connected through private networking. It may appear to be one cloud service but it contains several infrastructure relationships. IT leaders should map those relationships now. Identify applications, data stores, APIs, identity services, networking, backups, monitoring tools and supporting platforms. Then document where each component runs and who controls the infrastructure behind it.
The goal is not to predict the final FedRAMP classification. It is to eliminate uncertainty around the environment before that uncertainty affects a future compliance or modernization decision.
Define Who Owns Each Layer
Cloud environments often divide responsibilities between customers, providers, infrastructure partners and other vendors. Create a responsibility map covering five areas:
- Physical infrastructure ownership
- Infrastructure and platform management
- Security configuration and monitoring
- Maintenance, patching and recovery
- Evidence and documentation
Keep that information in architecture records, contracts, operating procedures, security documentation and ownership matrices where appropriate. This becomes particularly useful when a provider changes infrastructure or when a contractor needs to demonstrate who performs a specific operational activity.
Review Providers Beyond Their Current Status
A provider’s current FedRAMP status matters but it should not be the only vendor review question.
The FedRAMP Marketplace now provides information such as certification type, class, lifecycle phase and status. Contractors should verify that information and then ask providers about their future plans.
Key questions include:
- Is the service cloud hosted, self hosted or hybrid hosted?
- Which infrastructure providers support it?
- Does the provider plan to pursue 20x Class D?
- What architecture changes might be required?
- Which responsibilities remain with the customer?
- Could additional assurance work affect pricing or service design?
- What milestones should customers monitor?
Keep current certification status separate from proposed or future plans. A provider’s intention to pursue a future certification is not the same as holding that certification.
Consider the Cost of Change
Phase 4 should also be viewed as an operational planning issue.
Additional assurance engineering, assessments, infrastructure controls, monitoring or hosting changes could create costs for some providers. Those costs could eventually affect service pricing, architecture, migration requirements or internal IT workload. That does not establish a universal cost increase. The final requirements and each provider’s architecture will determine the actual impact.
For long running federal programs, however, IT leaders should ask whether a future provider change could require application redesign, data migration, integration work, additional monitoring or new support arrangements.
Cloud Provider Review Checklist
Before selecting, renewing or materially changing a cloud service, review:
Current status: Record the provider’s current FedRAMP certification type, class, lifecycle phase and status.
Hosting model: Document whether the service is cloud hosted, self hosted or hybrid hosted and identify major infrastructure dependencies.
Responsibilities: Record who manages infrastructure, platforms, applications, monitoring, patching, backups and incident response.
Evidence: Identify what operational and assurance evidence the provider maintains and how your organization can access relevant information.
Future plans: Ask whether the provider expects changes related to FedRAMP 20x, Class D, hosting architecture or assessment processes.
Cost and milestones: Identify potential cost or migration exposure and track official FedRAMP milestones separately from finalized requirements.
What IT Leaders Should Do Now
Contractors do not need to wait for Phase 4 to mature before improving their cloud readiness. Start by building a current inventory of cloud services supporting federal work. Include SaaS applications, infrastructure platforms, managed services, dedicated environments and important third party dependencies.
Next, document the hosting model and responsibility boundary for each service. Verify current provider information through the FedRAMP Marketplace and record the date of review. Then ask strategic providers about their Phase 4 plans. Vendor responses should distinguish between capabilities already in place, work currently underway and changes that depend on future FedRAMP decisions. Finally, connect these findings to modernization planning. If a service depends on infrastructure that could require significant changes, capture that dependency before a renewal, architecture decision or proposal commitment.
Keep Track of the 2026-2027 Transition
FedRAMP’s broader 20x transition is already underway. The 2026 Consolidated Rules entered optional early adoption on July 4 and the FedRAMP 20x Class B and C application pipeline opened August 31. Mandatory adoption of the 2026 Consolidated Rules is scheduled for January 1, 2027, subject to the rules’ specific applicability and effective dates.
Phase 4 has its own development timeline. FedRAMP currently identifies October 14 for a further Class D requirements RFC and plans additional work on self hosted and hybrid hosted services into 2027. The practical approach is to track official milestones, document current dependencies and avoid treating draft requirements as final obligations.
Managed IT Can Support Operational Readiness
FedRAMP developments can affect more than compliance documentation. They can influence cloud inventories, vendor coordination, infrastructure responsibilities, evidence collection and modernization planning.
Managed IT can help turn those activities into a repeatable operating process. Contractors may need support with cloud inventory, vendor coordination, infrastructure monitoring, operational documentation or modernization planning without outsourcing their entire IT function. XieTek’s Managed IT Services can support government contractors with cloud and hybrid environment management, technology inventory, vendor coordination, infrastructure monitoring, endpoint support, maintenance, security coordination and IT planning.
The goal is operational readiness: know what you operate, know who owns each layer and know what your providers are planning.
Frequently Asked Questions
Phase 4 is a proposed development phase focused on 20x Class D and pathways for self hosted and hybrid hosted cloud services.
No. RFC-0033 proposes development tracks and initial expectations. Detailed requirements are being developed through the Phase 4 process.
Hosting architecture determines where infrastructure responsibilities sit. Hybrid and self hosted environments can create different operational and assurance dependencies.
Ask about current certification status, hosting architecture, infrastructure dependencies, Class D plans, responsibility boundaries, evidence availability and expected changes.
Potentially. Additional assurance, assessment, infrastructure, monitoring or engineering work could affect some providers’ costs but RFC-0033 does not establish a universal increase.
Maintain a current cloud inventory, document responsibility boundaries, verify provider status, ask vendors about Phase 4 plans and track official FedRAMP milestones.
Strengthen Cloud Readiness Before Requirements Change
XieTek LLC provides Managed IT Services designed to help government contractors maintain cloud visibility, coordinate technology vendors and manage infrastructure responsibilities as federal requirements evolve. From cloud inventory and vendor coordination to infrastructure monitoring and modernization planning, our team helps organizations build operational readiness around current environments and emerging requirements.
Ready to strengthen your cloud operations before new FedRAMP developments affect planning and delivery? Contact XieTek LLC today to explore Managed IT support aligned with your technology environment and program requirements.