FedRAMP Rev 5 K.2: FRR5 to FRR8: assessment alignment, transition plans, monitoring visibility and public claims

What does K.2 require?

Providers align their security assessment plans to this policy so assessors test its requirements (FRR5); where an unvalidated module is not derived from an update stream of a validated module, document in the POA&M a plan to transition to validated modules or their update streams with regular progress updates (FRR6); give complete visibility into module use and versions in continuous monitoring data with no exceptions, and where using update streams retain artifacts showing updated major versions were submitted to the CMVP within six months of release (FRR7); and represent FIPS validation status in public documentation accurately using NIST-approved terminology, never ambiguous provider-defined terms such as FIPS compliant (FRR8).