FedRAMP
Continuous Monitoring (FedRAMP)
The post-authorization phase of FedRAMP requiring cloud service providers to submit monthly vulnerability scan results, deviation requests, and significant change requests, plus an annual 3PAO reassessment of one-third of controls. Continuous monitoring is where most FedRAMP authorizations are lost; agencies revoke authorization for sustained ConMon non-compliance more often than they deny initial authorization.