After authorisation the agency keeps monitoring the portions of the cloud environment the provider does not monitor, uses ongoing assessment and authorisation to detect changes in security posture for risk-based decisions, draws on the FedRAMP continuous monitoring strategy, the multi-agency continuous monitoring guide and the performance management guide to share monitoring responsibility and manage posture consistently, and, with the provider's permission, brings vendor security artefacts into its governance, risk and compliance tooling so that posture is visible to risk management framework stakeholders and authorising officials.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.