Providers SHOULD promptly and automatically acknowledge the receipt of messages received from FedRAMP in their FedRAMP Security Inbox.
AFC-CSO-CRA
Pass
Providers MUST complete the required actions in Emergency or Emergency Test designated messages sent by FedRAMP within the timeframe included in the message.
AFC-CSO-EMR
Pass
Providers MUST route Emergency designated messages sent by FedRAMP to a senior security official for their awareness.
Sets expectations for ethical conduct, workplace standards, reporting concerns without retaliation, and protecting information, and defines the progressive sanctions process for violations.
Defines how secure configuration baselines are established, enforced, and verified for the certification boundary, covering change control, infrastructure-as-code governance, drift response, patching, and least functionality.
continuous-monitoring-plan.pdf
Describes how the security posture of the certified system is continuously monitored, covering scanning, configuration and log monitoring, inventory, residual-risk tracking, and recurring reporting to FedRAMP and agency customers.
