Continuous monitoring follows NIST SP 800-137 to give operational visibility, managed change control and attendance to incident response, and a mature ConMon capability, evaluated during the assessment and the reviews, is a condition of authorization. Each month the provider uploads to the secure repository an updated POA&M under CA-5, an updated inventory under CM-8 at least monthly or on change, raw vulnerability scan files where agency agreements require them and scan reports, together with deviation requests, significant change requests, incident reports and the annual assessment package as they arise, using the FedRAMP repository at LI-SaaS, Low and Moderate and the provider's own at High; the provider bears primary responsibility for implementing and monitoring the SSP controls, cooperates fully with assessments, maintains the repository and promptly addresses findings, and each agency reviews the deliverables for its own use.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.