FedRAMP Rev 5 C.9: Collaborative continuous monitoring

What does C.9 require?

Under CA-7 an offering with more than one active ATO or ATU must implement collaborative ConMon, since FedRAMP does not monitor every Rev 5 service and each agency oversees its own use: the provider drafts a charter with member contact information (security representatives, usually ISSOs delegated by AOs, updated as agencies join or leave), a meeting schedule (a monthly one-hour meeting recommended, which may be skipped with deliverables posted when nothing has changed), an agenda covering scan results, past-due and vendor-dependent POA&Ms, open and newly approved deviation requests, significant change requests, the annual assessment, incident and emergency directive status, agency-specific reporting and questions, deliverables uploaded the same day each month a week before the meeting, decision-making authorities by voting members (at least two recommended) or a comment period (two weeks recommended) after which silence is approval, agency-specific requirements documented in contracts or ATO letters, and performance management triggers; holds an inaugural meeting to reach consensus, finalizes the charter in the repository, and runs the monthly meetings, forwarding new agency ATOs to FedRAMP and inviting the AO, distinguishing changes affecting all agencies from those for one, with impact-level uplifts led by the requesting agency and boundary additions needing existing customers' buy-in.