FedRAMP designated leads, the agency AO or the FedRAMP Director for program authorizations, review documentation of the module provider's approach to managing validation in its development life cycle against this policy (FRR18) and review SC-13 findings in the POA&M and the related risk documentation in the repository to ensure milestones are met on schedule (FRR19); package reviewers verify that all use cases and modules are accurately and comprehensively documented and reviewed by the assessor, including specific modules and versions (FRR20), and validate that assessment artifacts show a thorough evaluation wherever unvalidated modules meet a control requirement (FRR21).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.