Guide to FedRAMP continuous compliance

Once an organization earns its initial FedRAMP (or Federal Risk and Authorization Management Program) authorization, it must maintain ongoing security monitoring, vulnerability management and change control, all the while providing the government with annual assessments, incident reports and scan results. This is often governed by an internal FedRAMP project management office (or PMO). Failing to comply with FedRAMP requirements can result in the loss of authorization and resulting cancellation of agency contracts.

In March 2025, the General Services Administration (GSA) launched FedRAMP 20x, a new authorization path designed to accelerate the FedRAMP reporting process. The previous process, which will eventually be phased out in favor of FedRAMP 20x, is referred to as FedRAMP Rev5. While FedRAMP will stop accepting applications for new Rev5 Certifications on 11 June 2027, FedRAMP continues to support Rev5 while phasing in FedRAMP 20x practices.

FedRAMP 20x encourages a continuous monitoring strategy (or, in FedRAMP parlance, “ConMon”) and compliance by preferring “living evidence,” including “live demonstrations, direct queries, machine-readable results, and historical trends,” according to GSA instructions.

FedRAMP continuous compliance differs from the general practice of continuous compliance not only in its more specific application, but in the demands of FedRAMP compliance — including a heavier emphasis on change control through the logging and security assessment of every change to the system, the specific reporting requirements imposed from above (as opposed to being determined by the organization to meet business needs) and the greater number of external stakeholders involved, among other factors.

Some of the most crucial elements of an organization’s digital sovereignty — the ability to retain and demonstrate control and authority over its technology systems and ecosystems, data, operations and artificial intelligence (AI) — are aligned with the practice of FedRAMP continuous compliance. Especially through FedRAMP 20x, FedRAMP continuous compliance helps enable sovereignty by providing continuous visibility into how cloud systems operate.

Compliance with FedRAMP under the Rev5 legacy authorization model requires CSPs to work with a federal FedRAMP PMO to:

-       Implement particular security controls

-       Pass an independent assessment by a third-party assessment organization (3PAO)

-       Obtain an Authority to Operate (ATO)

-       Continuously monitor systems for compliance

Cloud service offerings can appear in the FedRAMP marketplace at defined stages before completing this process, depending on the applicable FedRAMP certification for their risk level.

FedRAMP’s required security controls are based on NIST SP 800-53, which mandates controls for the following categories, among others:

-       Incident response plans and evidence collection

-       Physical security posture

-       Vulnerability scanning and management

-       Penetration testing

-       Audit logging

-       Access control

-       Identity and authentication

-       Encryption

Under the Rev5 model, FedRAMP requirements vary with the offering’s authorized impact level. These risk assessments are categorized as Low, Moderate or High based on the potential effect of a loss of confidentiality, integrity or availability. Additionally, Li-SaaS is a low-impact baseline for qualifying SaaS offerings that feature limited functionality and data sensitivity (such as the inclusion of personally identifiable information, or PII). FedRAMP 20x uses certification Classes A through D (although D has not yet been made available), which are not equivalent to the Rev5 impact levels.

Most FedRAMP Rev5 assessments are performed by a FedRAMP-recognized third-party assessment organization, or 3PAO. These assessments evaluate whether the required security controls are established, whether they are operating effectively, and whether risk is adequately managed.

The organization first establishes a System Security Plan (SSP) that describes the IT environment, and then the 3PAO develops a System Assessment Plan (SAP) for how they will test the adequacy of the environment which is then recorded in a Security Assessment Report (SAR) that summarizes findings based on which the government will make a decision about whether to award an ATO. 

To obtain an Authorization to Operate (ATO), an organization must remediate any issues discovered during the 3PAO assessment and submit a package to regulators including:

-       The SSP and supporting documents

-       The SAP

-       The SAR

-       Findings about vulnerabilities

-       Their Plan of Action and Milestones (POA&M), a record of known vulnerabilities and planned remediation

-       The provider’s already-undertaken remediation steps

-       Known residual risks

Under the Rev5 agency authorization path, an authorizing official reviews the package and decides whether to accept residual risk and issue an ATO. Under FedRAMP 20x, FedRAMP issues the certification while agencies continue to make their own authorization decisions regarding use of the cloud service.

Once an ATO is issued, organizations must continually validate their ATO by meeting continuous monitoring requirements.

The FedRAMP Continuous Monitoring Playbook describes three main processes for monitoring:

-       Operational visibility, or the ability to produce logs and reports demonstrating compliance

-       Change control, or an established process for maintaining compliance amid changes to the system

-       Incident response, or “the ability to adequately respond to security incidents and emergency directives.”

In keeping with its emphasis on streamlined, continuous compliance, FedRAMP 20x shifts toward emphasizing:

-       automated validation

-       reproducible or “living” evidence

-       machine-readable reporting

-       continuous measurement

Continuous compliance, or the practice of continuously and automatically monitoring systems for compliance instead of performing periodic audits, supports the requirements for FedRAMP’s continuous monitoring program.

FedRAMP continuous compliance works by automating the processes of:

-       Monitoring and scanning the system

-       Reporting to federal agencies

-       Establishing change control

-       Assessing and updating the authorization package

Continuous compliance supports ConMon by automating the monitoring and scanning processes that produce evidence of compliance.

Vulnerability scanning is a core element of ConMon that can be largely automated as part of a practice of continuous compliance.

In the context of FedRAMP, vulnerability scanning involves:

-       Scanning operating systems, databases, web applications, infrastructure, container images and other components

-       Validating the results and evaluating them for risk and severity

-       Assigning responsibility for remediation and tracking and verifying its completion

-       Compiling and submitting reports on all of the above

Equally important to vulnerability scanning is the practice of maintaining observability, or the ability to analyze the functioning of a system by evaluating its outputs.

This process, which can be streamlined via automation, includes collecting logs, metrics, traces and other evidence about:

-       System and network configuration management

-       Vulnerabilities

-       Security events

-       User and privileged access

-       Control operations

-       Changes to the environment

-       Open findings and remediation status

ConMon requires configuration management, necessitating the tracking of configuration drift, when a network, app, device or other IT system gradually and unintentionally shifts away from its intended baseline settings.

This process can largely be automated as part of a continuous compliance practice, including tracking:

-       Emergency configuration changes

-       Manual modifications

-       The creation of new cloud resources

-       Untracked service dependencies

-       Changes to network rules

-       New privileged accounts

-       Software updates

-       Changes to encryption or logging

-       Expansion into new operating regions

CSPs can establish a continuous compliance practice for reporting to FedRAMP authorizing officials by using automation to identify potential updates to the POA&M and automating the creation of deliverables.

The Plan of Action and Milestones is a record of known weaknesses and their remediation plans. The POA&M needs to describe:

-       What the weakness is

-       Which systems are impacted

-       The risk or severity of the weakness

-       The remediation plan and status

-       Who is responsible for remediation

-       Any mitigating factors and dependencies

The ConMon process feeds information to the POA&M autonomously, and then automated services and practices can trigger remediation workflows.

Under Rev5, automation can help produce recurring deliverables such as vulnerability scan results, POA&M updates, inventory changes and remediation status. Under 20x, automation also supports machine-readable certification data, ongoing certification reports and continuously maintained validation evidence.

Change control is a crucial element of ConMon that requires CSPs to track what changes are made, why they are being made, and whether the changes are made in compliance with FedRAMP requirements, all of which can be supported by continuous compliance practices.

The core elements of automated compliance that support change control are:

-       Visibility, or providing basic information about what changes were made and why

-       Risk analysis, or evidence of the potential risk posed by a change

-       Governance, or ensuring that changes are classified correctly and conducted according to FedRAMP requirements

-       Validation, or ensuring that the change made is stable, secure and authorized

-       Assurance, or evidence of the above practices

Under the current Rev5 Agency Authorization and legacy Joint Authorization Board (JAB) models, CSPs undergo annual assessments that can include:

-       Developing the assessment schedule

-       Reviewing and updating documentation.

-       Conducting incident response and contingency plan testing.

-       Defining the assessment scope

-       Developing the SAP

-       Briefing agency customers on the plan

-       Conducting the security assessment and writing the SAR

-       Completing or updating the POA&M

Additionally, when a CSP serves more than one federal agency it must develop a collaborative ConMon strategy that identifies agency-specific requirements and establishes a streamlined process for generating reports for each agency.

FedRAMP 20x embodies many continuous compliance principles, which means that it emphasizes different means of monitoring and control compared to the legacy FedRAMP authorization process.

These include:

-       Key security indicators (KSIs), or defined and measured security outcomes (as opposed to measuring controls in place)

-       Machine-readable evidence, including live demonstrations, machine-readable results and historical trends about the security environment

-       Evaluation of the measurement and validation system itself, including information about resources and data included in its scope, the process of data collection, and measures when validation fails

-       Persistent validation instead of reliance on reporting snapshots

FedRAMP continuous compliance is the specific application of continuous compliance principles to FedRAMP authorization, and therefore has several key elements that differentiate it from the usual practice.

For Rev5 offerings, continuous monitoring supports agency decisions about maintaining an ATO. For 20x offerings, persistent evidence and ongoing reporting support continued FedRAMP certification and agency risk decisions. While traditional continuous compliance might often be meant to help an organization maintain general readiness for audits, FedRAMP continuous compliance has specific goals that are tied to their ATO.

Compared with point-in-time audit models, FedRAMP Rev5 places substantial emphasis on recurring vulnerability reporting, change management, annual independent assessment and ongoing agency oversight.

It also ties together a larger ecosystem of stakeholders, including:

-       Cloud service providers attempting to earn or maintain their ATO

-       Federal agencies who contract with those CSPs

-       Authorizing officials in the federal government

-       Third-party assessment organizations, or 3PAOs

FedRAMP 20x aligns the program more closely with continuous compliance by emphasizing automated evidence collection, machine-readable data, persistent monitoring and integration with DevSecOps practices.

FedRAMP 20x’s emphasis on continuous monitoring, automated evidence and ongoing validation can support business objectives related to digital sovereignty, the ability to retain and demonstrate control and authority over its technology systems and ecosystems, data, operations and artificial intelligence (AI).

The continuous visibility enabled by continuous compliance practices can help CSPs verify that they are operating with approved hosting regions, cloud environment standards, infrastructure configurations and service dependencies. Monitoring also validates administrative access restrictions, privileged access controls, separation-of-duties policies and encryption models, all crucial to satisfy sovereignty goals for who can access sensitive data.

Ongoing monitoring also more quickly detects violation of compliance that could result in costly fines under unrelated regulatory regimes. The orientation of FedRAMP 20x toward continuous measurement, validation and evidence supports sovereignty goals regarding controls, monitoring, automated compliance, machine-readable evidence and real-time attestation.