FedRAMP Rev 5 G.8: G.8 Continuous monitoring framework principles

The program office, with the Board and CISA and subject to OMB and DHS approval, establishes a continuous monitoring framework that prioritizes agility of development and deployment and DevSecOps, redesigns change oversight to monitor the provider's change process rather than individual changes so that providers can generally deploy changes and fixes without advance approval, gives CISA technical data to detect threats, avoids dividing cloud services into commercial and government instances, ensures incident response resilience through procedures, communication and reporting timelines, and is updated regularly for pressing threats and policies. The program office provides a standard level of monitoring support for the highest-impact controls to all agency customers, may convene a Board-approved special review of an existing authorization with an expedited deadline, informs the provider and agencies of significant vulnerabilities with escalation for those not addressed in time and may note unresolved concerns on the Marketplace, and maintains procedures with CISA for responding to Binding Operational and Emergency Directives.