Establishment of [DoD Assignment: monthly] for monitoring and [DoD Assignment: annually] for assessments supporting such monitoring; Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; Correlation and analysis of security-related information generated by assessments and monitoring; Response actions to address results of the analysis of security-related information; and Reporting the security status of organization and the information system to [DoD Assignment: Appropriate AO] [DoD Assignment: monthly]. DoD Additional Guidance: The CSP Continuous Monitoring strategy is expected to be consistent with CNSSI 4009 as well as NIST SP 800-137. DoD Additional Requirement: The vulnerability reports and POA&Ms developed by the CSPs as part of continuous monitoring requirements supporting both FedRAMP and FedRAMP+ requirements will be made available to DISA’s cloud services support team and subsequently to the MCD and BCD providers for their collective use in providing Cyber Defense. For both FedRAMP and FedRAMP+ requirements, high and critical risk findings must be mitigated within 30 days. Moderate findings must be mitigated within 90 days. Low findings must be mitigated within 120 days. DoD Additional Requirement: For CSO’s obtaining FedRAMP v2 baseline provisional authorization for the JAB, the CSP will provide all FedRAMP ISSO and all DoD-related continuous monitoring artifacts directly to the DISA AO representatives. CSPs, 3PAOs, and DoD assessors are responsible for providing deliverables attesting to the implementation of security controls. In some cases, CSPs will provide continuous monitoring artifacts directly to DISA. In such cases, the CSP will utilize commercial standard formats (e.g., comma-separated values, XML) that enable DoD to automate the ingest of continuous monitoring data. For XML exchanges, National Information Exchange Model (NIEM) based XML is the preferred format IAW DoDI 8320.07, August 3, 2015. DoD Additional Requirement: For CSOs obtaining FedRAMP v2 baseline authorization from a DoD SCA organization, all continuous monitoring reports and artifacts will be provided to the DISA AO representatives. DoD Additional Requirement: For CSOs obtaining FedRAMP v2 baseline authorization from a non-DoD Federal Agency, the CSP will provide all continuous monitoring materials and artifacts to the DISA AO representatives.
Establishment of [DoD Assignment: monthly] for monitoring and [DoD Assignment: annually] for assessments supporting such monitoring; Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; Correlation and analysis of security-related information generated by assessments and monitoring; Response actions to address results of the analysis of security-related information; and Reporting the security status of organization and the information system to [DoD Assignment: Appropriate AO] [DoD Assignment: monthly]. DoD Additional Guidance: The CSP Continuous Monitoring strategy is expected to be consistent with CNSSI 4009 as well as NIST SP 800-137. DoD Additional Requirement: The vulnerability reports and POA&Ms developed by the CSPs as part of continuous monitoring requirements supporting both FedRAMP and FedRAMP+ requirements will be made available to DISA’s cloud services support team and subsequently to the MCD and BCD providers for their collective use in providing Cyber Defense. For both FedRAMP and FedRAMP+ requirements, high and critical risk findings must be mitigated within 30 days. Moderate findings must be mitigated within 90 days. Low findings must be mitigated within 120 days. DoD Additional Requirement: For CSO’s obtaining FedRAMP v2 baseline provisional authorization for the JAB, the CSP will provide all FedRAMP ISSO and all DoD-related continuous monitoring artifacts directly to the DISA AO representatives. CSPs, 3PAOs, and DoD assessors are responsible for providing deliverables attesting to the implementation of security controls. In some cases, CSPs will provide continuous monitoring artifacts directly to DISA. In such cases, the CSP will utilize commercial standard formats (e.g., comma-separated values, XML) that enable DoD to automate the ingest of continuous monitoring data. For XML exchanges, National Information Exchange Model (NIEM) based XML is the preferred format IAW DoDI 8320.07, August 3, 2015. DoD Additional Requirement: For CSOs obtaining FedRAMP v2 baseline authorization from a DoD SCA organization, all continuous monitoring reports and artifacts will be provided to the DISA AO representatives. DoD Additional Requirement: For CSOs obtaining FedRAMP v2 baseline authorization from a non-DoD Federal Agency, the CSP will provide all continuous monitoring materials and artifacts to the DISA AO representatives.