FedRAMP 20x pilots expand Class D automation and evidence expectations

A proposed Class D pilot is open for comment through November 19, with reported provisions including weekly JSON reporting, API package sharing, PQC status, FOCI indicators, and a six-month Class C prerequisite; agency judgment on FOCI remains explicit. RFC-0036 separately proposes cloud-hosted pilot capabilities, while RFC-0034 and RFC-0035 details remain proposals rather than settled requirements; a newly read audit-preparation article adds no concrete guidance.