FedRAMP Rev 5 C.10: C.10 ConMon performance management and escalation

Providers must meet FedRAMP ConMon requirements and the conditions of the agency ATO letter; each authorizing agency reviews the monthly POA&M, approves deviation and significant change requests and reviews the annual assessment, and applies an escalation process of detailed finding review (assess a deficiency and report cause and remedy), corrective action plan (root-cause analysis and a formal remediation plan signed by the system owner and approved by the AO), suspension and revocation with data migration. The process runs from identification and comparison with past performance, through notification of the intended escalation, a provider response from the security point of contact or system owner, adjudication, a decision naming the criteria and deadline for return to satisfactory status, and the provider's response with root cause, milestones and dates, to notification of FedRAMP of suspensions, revocations and resolutions with CAP and release letters posted to the repository. Example deficiency triggers: unique vulnerability count up 20 percent or 10 from the ATO baseline, first non-compliant scanning incident in six months (unauthenticated scans at 10 percent or more), late High remediation of five or more items past 30 days, late Moderate remediation of ten or more past 90 days, poor deliverable quality, degraded change management or four or more incidents in six months lead to a detailed finding review; repeat scanning non-compliance, five or more High items past 60 days, ten or more Moderate past 120 days, SAP delivered under 60 days before the ATO anniversary, the annual package after the anniversary, lack of transparency or manipulated scans, recurrence within six months, change notice under 30 days or without an impact analysis, emergency change notice over five days late, undocumented changes, late incident notification, late Emergency Directive response, recurring incident types or missing daily zero-day updates lead to a corrective action plan. FedRAMP ensures the annual package is uploaded and complete, the latest SAR recommends continued authorization and the Marketplace reflects authorization, suspension and revocation status.