What FedRAMP High Means Now: Class D, and the Clocks That Come With It

Key takeaways

• High is now Class D. The 2026 class system absorbed the old impact levels: Class B took Low, Class C took Moderate, Class D took High. The assurance ladder itself got a new entry rung below them: Class A.
• The 20x route to Class D is not open yet. The program is piloting 20x Class D in late 2026 with formal availability in early 2027. Until then, Rev5 is the only route to Class D, and Rev5 typically requires an agency sponsor.
• Class D carries the program's tightest incident clocks. A severe incident at a Class D provider needs an initial report in fifteen minutes, updates every three hours, and a final report within three hours of recovery.
• The government warns against starting there. The program's own class page says to be careful starting with Class C or Class D: every dial in its class table, preparation, maturity, automation, validation, assurance, and cost, is at maximum.
• Most providers should never start at Class D. The classes are progressive by design; the government's guidance is to enter at Class A and climb as agency demand arrives.

What High was, and what Class D is

Under the old system, Low, Moderate, and High were impact levels in the FIPS 199 sense: the rating followed the worst-case impact on an agency if the service failed or was compromised. High meant the most sensitive unclassified workloads, the systems where failure is catastrophic, and the old High baseline stacked the largest control set on top of the Moderate one.

The 2026 rules kept the ladder logic and renamed the rungs. Class D is High's successor: the top assurance tier, the largest investment, the strongest commitments. Two things genuinely changed besides the name:

1. The ladder now starts lower. Class A is an entry tier that did not exist before, fed by a SOC 2 Type II or a recent readiness report. That makes the climb to Class D an actual climb, with intermediate listings buyers can see.
2. The obligations are explicit and clock-driven. The old High baseline was a control catalog. Class D under the consolidated rules carries defined operational deadlines, the sharpest ones in the program.

Who actually needs Class D

The honest answer starts with the agency, not the provider. Agencies categorize their own systems and data under their own FISMA process; a service chasing federal customers needs the class the agency's work demands, and not every agency workload is High. The practical patterns:

• Agencies running their most sensitive unclassified workloads: national-security-adjacent operations, law enforcement systems, and the workloads where the old High baseline was already the requirement.
• Providers with established federal demand at that level, usually with an agency relationship already in hand, which matters because until 20x Class D opens in early 2027, Rev5 is the only route and Rev5 typically wants an active agency sponsor.

If you are unsure whether your pipeline needs Class D, that uncertainty is itself the answer: enter at Class A, list, and let agency demand pull you up. The government's own words: your investment can scale with agency interest.

What Class D obligates you to

The incident reporting clocks. Per the 2026 incident rules, a Class D provider runs these deadlines after identifying a reportable incident:

Fifteen minutes is not a drafting deadline. It is a formatting deadline for a report your tooling assembles, which is why the rules' own automation guidance says modern cloud services should not report incidents by hand-crafting emails. (The full clock tables, all classes.)

The top of every other dial. The class page's impact table lists six areas that all rise together with class: preparation, federal process maturity, automation, verification and validation, agency assurance, and cost. At Class D every one of them is at maximum.

A status service, not just reports. The 2026 overhaul moved availability communication to a publicly accessible status service with visible history, and the top classes are where the program makes it mandatory.

The path to Class D

1. Enter the ladder and climb. Class A from a SOC 2 Type II or recent readiness report, then B, then C, upgrading as federal customers arrive. The program's stated sequencing lets a provider reach 20x Class C and then upgrade toward Class D faster than chasing a Rev5 Class D from zero.
2. Or take the Rev5 route today. For services on their own infrastructure, or with a sponsoring agency already in hand, Rev5 remains the only Class D route until the 20x pipeline opens in early 2027, after which new Rev5 certifications end on June 11, 2027.
3. Do not skip the read-the-room step. The program says plainly: be careful starting with Class C or Class D. The failure mode is spending a year building for the top of the ladder before a single agency has asked for it.

Frequently asked questions

Is FedRAMP High the same as Class D? Yes: the 2026 rules absorbed the old High impact level into Class D, adding Class A below the old Low/Moderate/High sequence as the entry tier.

Can I go straight to Class D? The Rev5 path exists for services that run their own infrastructure or already hold an agency sponsor, but the program explicitly cautions against starting at Class C or Class D. The designed path is progressive entry at Class A.

When does 20x Class D open? The program anticipates piloting 20x Class D in late 2026 and making it a formal certification option in early 2027. Until then Rev5 is the only Class D route.

What are Class D's reporting deadlines? For a severe incident: the initial report in 15 minutes, updates every 3 hours, and the final report within 3 hours of recovery. The full class-by-class tables are in the incident reporting guide.

What kind of data needs Class D? The agency decides under its own system categorization. Historically High covered the most sensitive unclassified workloads; if your agency customers are not demanding that level, a lower class serves them and costs far less to reach and hold.

The full ladder and its entry requirements: the 2026 path, class by class.