Collaborative continuous monitoring

Official source: Collaborative Continuous Monitoring (CCM), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.

In short

Every 3 months, you must give all necessary parties an Ongoing Certification Report (OCR). It summarizes what changed, what’s planned, accepted vulnerabilities, transformative changes, agency customers and reportable incidents. You must also offer a way to send feedback on each report and publish a summary of that feedback. Class C and D providers MUST host a live Quarterly Review with agencies every 3 months. Class B providers SHOULD, and Class A providers MAY. The goal is one shared stream of monitoring information that every agency can use, instead of separate requests from each agency.

Who it applies to

Subset	Type	Path	Class	Audience
Agency Guidance	20x, Rev5	Program, Agency	B, C, D	Agencies
Ongoing Certification Reports	20x, Rev5	Program, Agency	B, C, D	Providers
Quarterly Reviews	20x, Rev5	Program, Agency	B, C, D	Providers

Upstream says the provider subsets apply to “providers with any type of FedRAMP Certification.”

The subsets list Classes B, C and D, but CCM-QTR-MTG states a Class A variant (MAY). For Class A, FRC-CLA-MFR makes CCM-OCR-AVL and CCM-OCR-NRD mandatory, and FRC-CLA-RFR recommends CCM-QTR-MTG. FRC-CSO-PKG also requires a real or example Ongoing Certification Report in your initial Certification Package.

Key dates

	20x	Rev5
Status	Required (Consolidated Rules for 2026)	Required (Consolidated Rules for 2026)
Optional adoption allowed	2026-07-04	2026-07-04
Obtaining initial certification	2026-07-04	2027-01-01
Maintaining ongoing certification	2027-01-01	2027-04-02
Grace period ends	First FedRAMP independent assessment started after 2027-01-01	2027-10-01

What you need to do

Ongoing Certification Reports

Rule	Force	What it means for you
`CCM-OCR-AVL`	MUST	Every 3 months, supply an Ongoing Certification Report to all necessary parties. It must cover the whole period since the previous report, use a consistent human-readable format and include high-level summaries of the items listed below (if applicable).
`CCM-OCR-NRD`	MUST	Publish the target date of your next report with your other public FedRAMP Certification Data.
`CCM-OCR-FBM`	MUST	Provide an asynchronous way for all necessary parties to give feedback or ask questions about each report. Email works by default, but upstream encourages something more interactive.
`CCM-OCR-AFS`	MUST	Publish an anonymized, desensitized summary of the feedback, questions and answers, either as an addendum to the report or in the next report.
`CCM-OCR-LSI`	MUST NOT	Don’t irresponsibly disclose sensitive information in a report that would likely have an adverse effect on your offering.
`CCM-OCR-SOR`	SHOULD	Set a regular 3-month cycle that is “spread out from the beginning, middle, or end of each quarter.” The note says the aim is to stop hundreds of providers releasing reports in the first or last week of a quarter and overwhelming agencies.
`CCM-OCR-RPS`	MAY	Share some or all of a report publicly or with others if you determine it will NOT likely have an adverse effect on your offering.

What the Ongoing Certification Report must summarize (CCM-OCR-AVL), if applicable:

Changes to FedRAMP Certification Data
Planned changes to FedRAMP Certification Data during at least the next 3 months
Accepted vulnerabilities
Transformative changes
Updated recommendations or best practices for security, configuration, usage or similar aspects of the offering
A list of all agencies directly using the product
FedRAMP Reportable Incidents, or an attestation that none occurred
Lessons learned and changes planned or made as a result of FedRAMP Reportable Incidents (if any)

FedRAMP publishes an Ongoing Certification Report JSON schema.

Quarterly Reviews

Rule	Force	What it means for you
`CCM-QTR-MTG`	Varies by class (MAY for A, SHOULD for B, MUST for C and D)	Every 3 months, host a synchronous Quarterly Review, open to all necessary parties, covering the parts of your recent reports you judge most relevant to agencies. See differences by class.
`CCM-QTR-REG`	MUST	Give all necessary parties either a registration link or a downloadable calendar file for the Quarterly Review.
`CCM-QTR-NRD`	MUST	Publicly supply the target date of your next Quarterly Review with your other public FedRAMP Certification Data.
`CCM-QTR-NID`	MUST NOT	Don’t irresponsibly disclose sensitive information in a Quarterly Review that would likely have an adverse effect on your offering.
`CCM-QTR-SAR`	SHOULD	Schedule each Quarterly Review at least 3 business days after you release an Ongoing Certification Report, and within 10 business days of that release.
`CCM-QTR-ACT`	SHOULD	Add any other information you judge to be of interest or use to agencies.
`CCM-QTR-RTR`	SHOULD	Record or transcribe Quarterly Reviews and supply them to all necessary parties.
`CCM-QTR-RTP`	SHOULD NOT	Don’t invite third parties unless they have specific relevance. Your independent assessor counts as relevant by default.
`CCM-QTR-SRR`	MAY	Share recordings or transcripts publicly or with others ONLY if you remove all agency information (comments, questions, names and so on) AND determine it will NOT likely have an adverse effect.
`CCM-QTR-SCR`	MAY	Share content prepared for a Quarterly Review publicly or with others if you determine it will NOT likely have an adverse effect.

Agency guidance

These rules apply to agencies, not to you, but they explain who reads your reports and why.

Rule	Force	What it means for you
`CCM-AGM-ROR`	MUST	Agencies must review each Ongoing Certification Report to understand how changes may affect the risk tolerance in their Authorization to Operate. The note cites 44 USC § 35, OMB A-130, FIPS-200 and M-24-15.
`CCM-AGM-CSC`	SHOULD	Agencies should staff report reviews, Quarterly Reviews and other Certification Data monitoring in line with the Security Category in their Authorization to Operate.

Differences by class

Only CCM-QTR-MTG varies by class. The cadence is every 3 months for all classes. Only the force changes.

Rule	Class A	Class B	Class C	Class D
`CCM-QTR-MTG` Host a synchronous Quarterly Review every 3 months	MAY	SHOULD	MUST	MUST

The Ongoing Certification Report itself (CCM-OCR-AVL, every 3 months) is a MUST with no class variants.

What FedRAMP staff have said

Agency meeting tempo becomes quarterly for Rev5. When a Rev5 provider transitions to the 2026 rules, its tempo for agency meetings changes to a quarterly requirement under CCM-QTR-MTG. paulagosta, 2026-08-24, discussion #146

You set the Quarterly Review agenda. Before the rules were published, a staff member said the Quarterly Review should cover information from your most recent Ongoing Certification Report, such as significant changes, accepted vulnerabilities and incidents. You set the agenda, and dashboards and metrics are fine if they are relevant. Staff encouraged a meeting agencies want to attend, not a verbatim read-through of the report. The comment was labeled “Not official yet” and predates the 2026-06-24 launch. emu-gov, 2026-06-16, discussion #101

Certification data sharing: where public and agency-only Certification Data lives
Vulnerability evaluation and reporting: accepted vulnerabilities
Significant change notification: transformative changes
Incident evaluation and communication: FedRAMP Reportable Incidents
FedRAMP certification
Rev5 questions on the 2026 rules

Start here

Rule summaries

Discussion digests

In short

Who it applies to

Key dates

What you need to do

Ongoing Certification Reports

Quarterly Reviews

Agency guidance

Differences by class

What FedRAMP staff have said

​In short

​Who it applies to

​Key dates

​What you need to do

​Ongoing Certification Reports

​Quarterly Reviews

​Agency guidance

​Differences by class

​What FedRAMP staff have said

​Related

In short

Who it applies to

Key dates

What you need to do

Ongoing Certification Reports

Quarterly Reviews

Agency guidance

Differences by class

What FedRAMP staff have said

Related