What FedRAMP continuous monitoring requirements apply in 2026?
After a cloud service receives a FedRAMP authorization, the provider must send an Ongoing Certification Report every 3 months, and that report must cover the whole period since the previous one. Quarterly reviews with agencies follow the same cycle but vary by class: they are optional for Class A, recommended for Class B and mandatory for Classes C and D, ideally held 3 to 10 business days after the report is released. Under the Consolidated Rules for 2026, these obligations sit inside the Collaborative Continuous Monitoring rules, so a provider should read the rule text for its own class rather than rely on a summary.
The depth of the work also depends on class and on the provider's own risk profile. The annual independent assessment must include a set number of SP 800-53 controls and enhancements that rises from 35 for Class B to 80 for Class C and 101 for Class D, so a Class C or D provider should plan its control evidence for a larger set each year. The organization owns and operates its controls. An independent assessor tests them and issues the assessment results, and an implementation partner can prepare systems, logs and evidence for that work but cannot issue any report.
Agencies use each Ongoing Certification Report to judge whether changes to the service affect the risk tolerance written into their own authorization to operate. Providers should therefore confirm, with their FedRAMP package and sponsoring agencies, which changes must be reported and how the report will show them. Before the first report is due, confirm who receives it, how agency questions are logged and answered, and which owner signs off on the content.
How the Ongoing Certification Report works every 3 months
Under the Collaborative Continuous Monitoring rules, the Ongoing Certification Report is the main artifact that carries a FedRAMP authorization forward between assessments. The cards below cover what the rule requires, what the provider assembles, and what the organization must keep current so each report is accurate when it is released.
The reporting period rule
The rule requires a provider to deliver an Ongoing Certification Report to all necessary parties every 3 months. Each report covers the whole period since the previous one, so a change or event in the middle of a quarter cannot fall between two reports. Check that your monitoring records and change logs run continuously across the boundary between reports, not just within the quarter you are reporting on.
Consistent human-readable format
The report must be in a consistent, human-readable format so agencies can compare one period with the next. Consistency matters more than presentation: the same sections, the same identifiers for changes and controls, and the same status vocabulary should appear every quarter. Agree the template with your authorizing officials early and keep it stable, because a format that shifts between reports makes trend review harder for every reader.
Change log for the period
The report must reflect how the cloud service changed during the period, which is the input agencies use to judge effects on their own risk tolerance. Maintain a change record that captures each modification to the system, its date, its security relevance and the decision taken. Confirm with your authorizing body how minor, routine and significant changes are classed before the first report, since the classification drives what appears in it.
Incidents and vulnerability status
Agencies need to see security events and the state of known weaknesses in the period, not only the list of changes. Keep an incident register and a vulnerability register that record detection dates, remediation status and any open items at the end of the period. Reconcile these registers with your scanner output before each release so the figures in the report match the source systems.
Control status and assessment updates
The report also needs the current status of the controls in scope, including any changes to implementation and the results of recent assessment activity. Keep a control implementation record that is updated when a control changes, not at the end of the year. Ask your assessor which control results must be reflected in each quarter and which wait for the annual independent assessment.
Asynchronous questions from agencies
The rule gives agencies an asynchronous way to ask questions between reports. Assign a named owner and a tracked queue for these questions, with a record of each answer and its date. Unanswered questions about a report quickly become findings in the next review, so confirm response expectations in your agreement with the provider.
Quarterly reviews by FedRAMP class
This table compares Classes A to D against the quarterly review rule (CCM-QTR-MTG), which makes a synchronous review every three months optional for Class A, recommended for Class B and mandatory for Classes C and D. Read each row as a planning question: who must be in the room, what the provider must bring, and how much staff time the buyer should hold for each review.
| Class | Quarterly review status | What to plan for |
|---|---|---|
| Class A | Optional | Agencies may decline the synchronous meeting and rely on the Ongoing Certification Report and asynchronous questions. Confirm your agency's preference before the first cycle. |
| Class B | Recommended | Plan for attendance from the authorizing official's delegate and security staff. Treat the meeting as the default unless you formally decide otherwise. |
| Class C | Mandatory | Schedule the review for every quarter. Staff with people who can answer on risk acceptance, changes and open findings from the report. |
| Class D | Mandatory | Same as Class C, with the highest expected volume of questions. Block recurring time on calendars for the review and the preparation before it. |
| Who attends | Agency authorizing officials, system owners, security and compliance staff, plus the provider's security and compliance leads | Confirm the attendee list with the provider and your agency. Buyers usually need the people who own risk decisions, not only operators. |
| What the provider prepares | The Ongoing Certification Report, a summary of changes, open findings and answers to questions submitted in advance | Ask the provider for the agenda and the question intake process before each review, so the meeting is not used for first-time questions. |
| Timing | Ideally 3 to 10 business days after the Ongoing Certification Report is released | Build the review window into your quarterly calendar so it follows report release, not a fixed date. |
| Buyer preparation | Review the report against your own authorization to operate and note items that affect your risk tolerance | Assign a reviewer to read the report before the meeting. Time for this review is separate from the meeting itself. |
How agencies must use the reports under CCM-AGM-ROR
Under the FedRAMP rule CCM-AGM-ROR, each agency that relies on a cloud service must review every Ongoing Certification Report it receives and work out how the changes described in that report may affect the risk tolerance written into the agency's own authorization to operate (ATO). The rule ties this duty to the federal information security framework: 44 USC 35 (the Paperwork Reduction Act, which carries the FISMA provisions), OMB Circular A-130, FIPS 200 and OMB memorandum M-24-15. The practical consequence is that a report is an input to the agency's risk decision, not a notice it can file. An agency security team should compare each report against the risk acceptances, compensating controls and conditions in its own ATO package, and record whether any change calls for follow-up with the provider, a change to its own monitoring, or a formal review of the authorization.
The agency owns the ATO decision. The provider does not decide whether the agency keeps operating the service, and FedRAMP's rules do not transfer the agency's risk acceptance to the provider. The provider's obligation is to supply reports that are accurate, complete for the whole period since the previous report, and written so that a non-specialist reviewer can follow them. Agencies that depend on the report should confirm with each provider which changes it treats as material, how it describes open vulnerabilities and remediation status, and how to submit follow-up questions through the asynchronous channel the rules require. An agency should also decide, in advance, who reads each report, who has authority to act on it, and what triggers an escalation to the authorizing official.
The reports also shape the quarterly review. Where the rules make a synchronous review mandatory or recommended for a class, agencies should arrive with questions drawn from their own review of the latest report, not from a general reading. Teams planning this work should confirm, with their agency and provider, how review notes will be recorded and retained so that the agency can show later how it handled each change. Note that this section describes the agency's duties under the rule as published in the Consolidated Rules for 2026. Confirm the current text in the rules repository before relying on it, since the rules are versioned and may change.
Which controls an independent assessor must test every year
FedRAMP's independent assessment rule for Rev5 certifications, identified as IVV-CSF-AIA in the Consolidated Rules for 2026, lists the SP 800-53 controls and control enhancements that must be included in a FedRAMP independent assessment at least once a year. The list is fixed by class, so the scope of the annual assessment is known in advance. Read the rule itself before planning, because the list in the rule is the authority for what must be covered, not the general SP 800-53 baseline.
- Class B: 35 controls and enhancements must be included in the annual independent assessment.
- Class C: 80 controls and enhancements must be included each year.
- Class D: 101 controls and enhancements must be included each year.
- Scope grows with class: moving from Class B to Class D more than doubles the annual test scope, so the planning effort rises with impact level.
- Confirm the current list: check the rule text for the exact controls in your class, since the list is maintained by FedRAMP and may change.
Before planning the year, confirm your class using FedRAMP's class guidance and map each required control to the owner and evidence source that will support it.
The independent assessor, not DeployOpen, produces the assessment results for the controls in the annual scope. The assessor examines the evidence, interviews staff and performs tests as the assessment method requires, then reports findings. DeployOpen does not issue audit reports, attestations or certifications, and it does not decide whether a control passes. Keeping these roles clear protects the independence the rule depends on.
- Assessor owns the result: the independent assessor determines whether each control in scope is satisfied and documents the findings.
- Provider owns the controls: the cloud service provider implements, operates and documents each control in its own environment.
- Implementation partner supports preparation: DeployOpen can prepare systems, configurations and evidence packages under a written scope, but it does not assess or certify.
- Assessor independence: confirm with the assessor how it will meet the independence requirements in the rule before engagement.
- Engagement terms: agree in writing who provides which artifacts, in what format and by what date.
Ask your assessor which controls in the annual scope it expects to test through interviews, examinations and technical tests, so you prepare the right evidence for each.
The provider prepares evidence for the independent assessor. Good preparation means that each control in the annual scope has a named owner, a documented procedure and recent artifacts that show the control operated over the period. Evidence gaps are usually found late, so an internal check of the annual list before the assessor begins saves time and cost.
- Map every in-scope control: list each required control or enhancement for your class and link it to a procedure, owner and evidence source.
- Collect operating evidence: keep logs, scan results, change records, access reviews and training records that show the control ran during the period, not only that it is written down.
- Keep the system security plan current: the assessor will compare the plan with what the system actually does, so update it with each significant change.
- Run an internal pre-assessment: test a sample of in-scope controls against their evidence to find gaps while there is still time to fix them.
- Track open findings: record findings from earlier assessments and the status of each remediation in your plan of action and milestones.
Before the assessment starts, ask the assessor for its evidence request list and confirm the format and delivery method for each item.
What the recurring monitoring cycle looks like in practice
The cycle turns a continuous stream of system changes into a single, consistent record that the provider delivers to every party that relies on the authorization, and then gives those parties a structured chance to question it. Each phase has a named output, so the provider and its agencies can show that every period was covered.
Capture changes and monitoring results across the period
Throughout the reporting period, the provider records changes to the cloud service, vulnerability and configuration results, incidents and control assessment activity in its own systems of record. The provider owns this log, and an implementation partner can help configure the tooling that collects it. The step is complete when every change and result since the last report has a dated entry that can be traced to a source system.
Assess each change against the documented risk
The provider reviews each captured item to decide whether it changes the risk posture described in the authorization package, and whether it falls under a change type that requires notice. The security team owns this decision and records the rationale. The output is a reviewed list in which every item is marked with its effect on the documented controls and risk, so that nothing is left unclassified before drafting starts.
Update the package and open items
The provider updates the affected parts of the system security plan, the plan of action and milestones and the inventories so they match the current state of the service. Open findings are reconciled against remediation records. The step is done when the working documents reflect the period's changes and each open item has a current status, owner and next action.
Compile and deliver the Ongoing Certification Report
The provider prepares the Ongoing Certification Report, which covers the whole period since the previous report in a consistent, human-readable format, and sends it to all necessary parties. The FedRAMP rule requires delivery every 3 months and an asynchronous channel for agency questions. The output is a dated report and a delivery record for each recipient, which the provider keeps as evidence.
Hold the optional or required quarterly review
Depending on the service's class, a synchronous review may be optional, recommended or mandatory. Where it applies, the review is scheduled ideally 3 to 10 business days after the report is released, so agencies can ask questions live. The output is meeting notes that list questions, answers and any follow-up actions with named owners. Providers should confirm the requirement for their class in the current rules before scheduling.
Review the report against each agency's authorization
Each agency reviews the report to judge how the changes may affect the risk tolerance written into its own authorization to operate. This review is the agency's responsibility, not the provider's, but the provider should expect questions and respond through the agreed channel. The agency's output is its own risk decision or a request for further information, which the provider tracks as an open item.
Close follow-up and carry items into the next period
The provider answers outstanding questions, records any agreed actions and feeds them into the next period's change capture and plan of action and milestones. Items still open at the end of the cycle stay on the list with their status. The step is complete when every question has a recorded answer or a tracked action, which becomes the starting point for the next reporting period.
What changes on 1 January 2027 and 11 June 2027
The Consolidated Rules for 2026 take mandatory effect on 1 January 2027, and FedRAMP stops accepting applications for new Rev5 certifications on 11 June 2027. Providers planning a new authorization or a change to an existing one should treat these two dates as the planning anchors for the rest of this page. The rules that matter for continuous monitoring, including the Ongoing Certification Report cadence and the Quarterly Review classes, are the ones that will apply once the mandatory date arrives, so a package that is still in progress needs its monitoring design checked against them.
Before committing engineering time, confirm which rules apply to your package. Check the FedRAMP timeline page directly, since it sets out the important dates for the Consolidated Rules for 2026 and is the authoritative source for any transition arrangement. Then compare the rule set your assessor and your authorizing agency are working from against the version you are building to. The machine-readable rules repository also records a specific rules version, so note the version you relied on when you document your decisions. If your timeline runs past the application cutoff, ask your independent assessor and sponsoring agency in writing how the cutoff affects your path to a new Rev5 certification.
A practical check is to list every continuous monitoring deliverable your package will owe, mapped to the date it first becomes due. That list shows where a late start would leave you without evidence the rules expect, and it gives you a concrete basis for asking an implementation partner or assessor what they can prepare before each date.
What must be in place before the first report is due
Under the Consolidated Rules for 2026, a provider's first Ongoing Certification Report covers the whole period since certification, so gaps in monitoring become visible at the first report. The cards below cover the readiness items a provider should verify before that date, and each one names a specific check the provider or its implementation partner can run.
Documented continuous monitoring strategy
The strategy names the controls monitored, the frequency of each assessment, the tools that produce the data, and who reviews the output. Check that the document matches what the systems actually do today, since an assessor will compare the two. Confirm that the strategy covers the controls assessed every year for your class, which the independent assessment rules list by number. A strategy that describes tools you do not run is the most common readiness gap.
Named reporting owner
One person owns the Ongoing Certification Report from data pull to release, and a named deputy covers absences. The owner signs off on the content, confirms that each section traces to evidence, and keeps the release calendar. Check that the owner has access to the monitoring tools, the change log and the ticketing system, because a report assembled from memory will not match the record.
Evidence collection mapped to class controls
For each control in your class, record where the evidence comes from, how often it is collected, and where it is stored. Run a test pull for one control from each family to confirm the output is readable and complete. Check the control list against the independent assessment rules for your class, because evidence gaps on those controls are the ones an assessor will question first.
Change log covering the full period
The whole-period report requires every change since the last report, so the change log must capture configuration, software, personnel and boundary changes with dates, approvers and impact notes. Check that a sample of recent changes can be traced from the ticket to the deployment record and to the security review. Missing entries are hard to reconstruct once the report window closes.
Vulnerability and remediation records
Scan results, triage decisions and remediation dates feed the report and show whether findings are closed within the timeframes in your plan. Check that scanner coverage matches the inventory, that exceptions carry an approver and an expiry date, and that the report can show open findings by age. An exception without documented risk acceptance is a finding in its own right.
Tested agency question process
The rules require an asynchronous way for agencies to ask questions about each report, and Classes C and D also face mandatory synchronous reviews. Run a rehearsal: submit a sample question, route it to the right engineer, and send a written answer within your internal target. Check that the answers are logged so the same question does not reopen later.
Who owns the controls, who prepares evidence and who issues the assessment
The cloud service provider owns the authorization boundary and the controls inside it. It is accountable to FedRAMP and to its agency customers for implementing the SP 800-53 controls it selected, for operating them every day, and for producing the Ongoing Certification Report that describes changes, incidents, vulnerability results and deviations since the last report. Ownership means the provider decides how a control works, who runs it and what happens when it fails. An implementation partner can help build or document those mechanisms, but the provider remains responsible for them.
- Control ownership: the provider assigns each control to a named owner, whether a system, a team or an inherited common control.
- Operating records: tickets, change approvals, scan results and access reviews are generated as part of normal operations, not assembled for the audit.
- Ongoing Certification Report: the provider writes and releases it every three months, covering the whole period since the last report.
- Agency communication: the provider answers agency questions through the asynchronous channel FedRAMP requires.
Check whether your provider can name the owner, the operating record and the reporting cadence for each control in your boundary.
An implementation partner such as DeployOpen works inside the client's own infrastructure to plan, build, configure, harden and document the systems that carry controls, and to organize the evidence those systems produce. Its work includes setting up logging, scanning and configuration tooling, mapping controls to the procedures that run them, and preparing the packages an assessor will read. The partner does not own the controls, does not decide risk acceptance, and does not issue reports or attestations. DeployOpen prepares systems, controls and evidence for compliance assessments; independent auditors and certification bodies issue the results.
- System preparation: configuration, hardening and integration of the self-hosted platforms that generate continuous monitoring data.
- Evidence preparation: consistent collection, retention and indexing so the provider can draw on accurate records each quarter.
- Documentation support: drafting procedures and mapping them to the SP 800-53 controls they support, for the provider's review and approval.
- Scope boundary: work is agreed as a fixed scope in writing before it starts, with deliverables and timelines stated.
- Ongoing support: retainers can cover upgrades and continuous testing, but these do not change who owns the assessment.
Ask any partner to state in writing that it does not issue reports, attestations or certifications.
The independent assessor tests whether the controls work as described. For FedRAMP Rev5 certifications, the independent assessment is carried out by a third-party assessment organization under FedRAMP's rules, and the assessor is independent of both the provider and the team that prepared its systems. The assessor examines the evidence, interviews staff, tests controls and reports findings. The FedRAMP rules also require certain SP 800-53 controls to be included in an independent assessment at least once a year, and the number depends on the impact class.
- Independence: the assessor must not design, operate or prepare the controls it tests.
- Annual coverage: the rules list the controls that must be included each year, which is 35 controls and enhancements for Class B, 80 for Class C and 101 for Class D.
- Assessment output: findings and the assessment report are issued by the assessor, not by the provider or its partner.
- Procedures: SP 800-53A describes the examine, interview and test methods assessors use for each control.
- Fees and scope: assessor cost depends on the boundary and the class, and should be quoted by the assessor directly.
Confirm the assessor's independence and its FedRAMP recognition before you rely on any assessment result.
Responsibility for each deliverable can be traced to one role. The provider signs the Ongoing Certification Report and accepts risk. The assessor signs the independent assessment report and any attestation it issues. The implementation partner signs its own statements of work, delivery notes and documentation it authored, but none of the outputs that a customer or agency relies on for authorization decisions. Mixing these roles creates an independence problem that assessors and agencies will notice quickly.
- Provider deliverables: the Ongoing Certification Report, change notifications and the plan of action and milestones.
- Assessor deliverables: the independent assessment report and assessment findings.
- Partner deliverables: system configurations, evidence packages, procedure drafts and the test records it produced.
- Agency role: agencies review the Ongoing Certification Report against their own authorization to operate.
- Records: keep a RACI or equivalent that names the signer for each artifact.
Before engagement, ask the provider and partner to confirm in writing which party signs each artifact in your continuous monitoring cycle.
How much effort does FedRAMP continuous monitoring take?
What does the every-3-months Ongoing Certification Report require from our staff?
It requires a named owner who can pull evidence for the whole period since the last report and write it in a consistent, human-readable format. FedRAMP's Collaborative Continuous Monitoring rules ask providers to cover everything that happened since the previous report, not only the recent quarter, so the work is mostly collection and reconciliation. Staff must track changes, vulnerability results, incidents, significant changes and open items across the quarter. Effort rises sharply when evidence is scattered across ticketing, cloud consoles and spreadsheets. It falls when scanner output, change records and access reviews are generated and stored continuously. Ask your partner to show how the report is assembled from source systems and who signs off each section.
How do quarterly reviews change our meeting and planning calendar?
A quarterly review is a synchronous session held after each Ongoing Certification Report, and the rules ask that it take place roughly 3 to 10 business days after the report is released. Whether you must hold it depends on your impact class: optional for Class A, recommended for Class B and mandatory for Classes C and D. Plan the report-to-review window into every quarter so the people who answer agency questions are available. Preparation includes reviewing the report, drafting answers to likely questions and confirming open remediation items. Build this into release freezes and change windows so a review does not land during a major deployment.
Can our own team run FedRAMP continuous monitoring in-house?
Yes, an organization can run continuous monitoring with its own staff, provided it has people who understand the SP 800-53 controls in scope, the FedRAMP reporting format and the operation of its scanners, logging and change process. The organization owns its controls and remains accountable for the report. Many teams split the work: internal staff own decisions, access reviews and incident handling, while an implementation partner builds the tooling, evidence pipelines and documentation. Confirm your capacity against the controls assessed each year for your class, because annual independent assessment work competes with the same people.
What drives the effort of continuous monitoring up or down?
The biggest drivers are impact class, system size and how much evidence is already generated automatically. A higher class brings more controls into the annual assessment and a mandatory quarterly review. Many cloud services, integrations and third-party components enlarge the report and the change log. Mature automation pays off: scanner exports, configuration baselines, centralized logs and ticket-linked change records reduce manual compilation. Frequent significant changes also add work because each needs analysis and agency notification. Ask for a quote that separates one-time build work from recurring quarterly work so you can compare the two honestly.
What does the annual independent assessment need from our team?
The annual independent assessment must include a set of SP 800-53 controls and enhancements chosen by your impact class, and an independent assessor performs it. FedRAMP lists 35 controls and enhancements for Class B, 80 for Class C and 101 for Class D. Your team prepares system documentation, assessment objects, configuration evidence, sample records and interview availability for the assessor. The assessor's findings are the assessor's, and the authorization decisions remain with the agency or FedRAMP. Plan internal time for pre-assessment checks, evidence walkthroughs and remediation of findings. Confirm the assessor is independent of the team preparing your evidence.
What should a fixed-scope quote for continuous monitoring include?
A fixed-scope quote should state the boundary of the system, the impact class, the controls and evidence sources in scope, and the number of report cycles covered. It should list deliverables such as the report template, evidence pipeline, runbooks and the quarterly review support, with acceptance criteria for each. Ask which tasks are one-time, such as building automation, and which recur, such as quarterly reports and reviews. Confirm what is excluded, including annual assessment fees charged by the independent assessor, remediation work, and any changes to the system after the boundary is agreed. DeployOpen prepares systems and evidence under written scope; it does not issue reports or attestations.
Which FedRAMP rules and dates should we confirm before budgeting?
Confirm the current rules directly with FedRAMP before fixing your budget. The Consolidated Rules for 2026 take mandatory effect on 1 January 2027, and FedRAMP will stop accepting applications for new Rev5 certifications on 11 June 2027, according to its important dates page. Review the certification and independent verification rules for your class, because requirements differ by class and rules are updated. Ask your partner which rules version the quote assumes and how it will be updated if FedRAMP changes a requirement during the engagement.
Official FedRAMP and NIST sources to read next
Start with the FedRAMP Consolidated Rules for 2026 certification rules, because they set the Ongoing Certification Report cadence, the Quarterly Review obligations by class and the agency review duty that this page describes. Read the FedRAMP Rev5 certification rules with your authorizing official's expectations in mind, and note which rules apply to your class under the choose-a-class guidance. The machine-readable copy in the FedRAMP rules repository, version 2026.10.13.01, is useful for tracing rule identifiers such as CCM-OCR-AVL and CCM-QTR-MTG into your compliance calendar.
Next, read the independent verification and validation rules, which determine how the annual assessment of controls is scoped and who performs it. The FedRAMP Rev5 independent verification and validation rules list the minimum control counts by class that must be covered once a year. Confirm with your assessor which controls fall into that list for your system, and check that your continuous monitoring plan schedules them rather than treating the annual assessment as a one-time event.
Before you commit dates to a plan, check the FedRAMP important dates timeline, which gives the mandatory effective date of the Consolidated Rules for 2026 and the cutoff for new Rev5 certification applications. Pair that with the NIST SP 800-53A Rev. 5 assessment procedures on CSRC, which define the determination statements and examine, interview and test methods your assessor will use to judge each control, and with the OSCAL catalog in the usnistgov/oscal-content repository for machine-readable procedures. Ask your assessor which release of SP 800-53A they will test against.
How DeployOpen prepares monitoring evidence for FedRAMP
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares the systems and evidence that feed FedRAMP continuous monitoring. We do not issue reports or attestations; your independent assessor and the FedRAMP process do that.
How we scope
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
- The written scope names the systems, boundaries and SP 800-53 controls whose monitoring evidence we will prepare.
- Scope also states the Ongoing Certification Report inputs we will assemble and which party owns each control.
How we build
- We configure logging, vulnerability scanning and change records so each quarterly reporting period can be reconstructed.
- We test monitoring tooling and evidence collection against the control set your scope defines before handover.
- We document how each evidence source maps to the controls assessed each year under the FedRAMP independent assessment rules.
How we hand over
- You receive documented procedures, evidence collection runbooks and an explanation of where each artifact is stored.
- Deliverables are organized so your team and your independent assessor can trace each claim to a source record.
- Handover includes a walkthrough of how to prepare each periodic report in a consistent, human-readable format.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover maintaining monitoring tooling as the platform changes and as FedRAMP rules are updated.
- Confirm with us in writing which support tasks the retainer includes before the engagement begins.
