After a PA is granted the CSP keeps up the CSO's security posture by scanning for vulnerabilities continuously and periodically, undergoing DoD annual assessments, managing incidents and running sound operational processes, following the FedRAMP continuous monitoring strategy for FedRAMP-catalogue CSOs with DoD-specific additions (reporting to DISA as well as the FedRAMP PMO), or the DoD continuous monitoring requirements for DoD-assessed CSOs; POA&M items are tracked, and high and critical findings are mitigated within 30 days and moderate findings within 90 days (section 6.7).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.