After authorization, FedRAMP expects a steady rhythm: monthly deliverables such as an updated POA&M, inventory and vulnerability scan results, an annual assessment and an approval process for significant changes. The details below come from FedRAMP's Continuous Monitoring Playbook dated 17 November 2025. FedRAMP has also published consolidated rules for 2026, so check which applies to you.
What changes between "authorized" and "operating"?
During assessment you prove controls exist. In continuous monitoring you show, regularly, that they still work. The playbook says deliverables and supporting evidence are provided monthly, annually, every three years and as needed, with minimum frequencies for each control listed in a baseline workbook.
Safeguard does not hold FedRAMP authorization; FedRAMP High and IL7 are architecture targets for us. This post explains the framework only.
What happens every month?
Per the playbook, security control CA-5 requires a plan of action and milestones (POA&M) to document remediation plans, and CM-8 requires an updated inventory at least monthly or when there is a change. Each month the provider uploads an up to date POA&M and inventory, along with raw vulnerability scan files when agreements with agency customers require them, and reports to the secure repository. Agency authorizing officials review these to confirm the risk posture still suits their use.
The scanning rules are specific. Operating systems, web applications and databases must be scanned monthly. For Moderate and High systems, authenticated scans are required wherever possible, and scans must run with full system authorization. Scan output must show all findings of low risk or higher in a structured, machine readable format such as XML, CSV or JSON.
Each unique vulnerability must be tracked as its own POA&M item. You may split one into several items but must not group several unique vulnerabilities into one. This is a common source of rework for teams that track at the package level.
The playbook also recommends, but does not require, a monthly one hour collaborative meeting with agencies to cover scan results, past due items, deviation requests and significant change requests.
What about changes to the system?
A significant change is defined, citing NIST SP 800-37 Rev. 2, as a change likely to substantively affect the security or privacy posture of a system. The playbook describes three types: routine recurring, transformative and adaptive. Routine recurring changes, such as regular patching, do not need authorizing official approval. Transformative and adaptive changes do. An uplift from Low to Moderate or Moderate to High counts as a significant change.
The newer FedRAMP definitions page lists significant change subtypes as adaptive, routine recurring, transformative and certification class change, so terminology is moving. Confirm which rules govern your authorization.
And the annual assessment?
Providers are assessed at least annually by an independent assessor. The scope is set with the agency using a control selection worksheet. It includes validation of POA&Ms closed since the last assessment and of items marked as vendor dependencies or deviation requests. Results from an approved out of cycle significant change assessment can sometimes be reused if conditions are met.
What trips teams up?
Inventory drift: assets that appear in the cloud but not in the inventory. Scans that run without proper authorization and so miss findings. POA&M items grouped for convenience. And significant changes shipped before the approval step. Build checks for each into your release process.
What to do
- Calendar the monthly upload and tie it to a named owner.
- Automate the inventory export and reconcile it against your cloud account.
- Configure authenticated scans and prove they ran with full access.
- Track one POA&M item per unique vulnerability.
- Add a change classification step to your pipeline: routine, adaptive or transformative.
- Prepare for the annual assessment by reviewing closed items and open deviation requests quarterly.
- Re-read current FedRAMP rules for your authorization path each quarter.
Quick check
Do I need agency approval to patch?
Routine recurring changes such as regular patching do not need authorizing official approval under the playbook.
Can I group vulnerabilities in one POA&M item?
No. The playbook says each unique vulnerability must be its own item.
Sources
- FedRAMP Continuous Monitoring Playbook v1.0, 17 November 2025
- FedRAMP Consolidated Rules for 2026: definitions
Last reviewed: 18 October 2026.
