FedRAMP
ConMon Reports
The monthly continuous monitoring deliverables FedRAMP requires from authorized cloud service providers: vulnerability scan results from operating system, web application, and database scanners; an updated Plan of Action and Milestones; a deviation request log; and an inventory of changes. Late or incomplete ConMon submissions are the most common trigger for FedRAMP corrective action and, in repeated cases, authorization suspension.