Staying FedRAMP Certified

Ongoing 20x obligations: CCM / quarterly OCR, Rev5 monthly ConMon while that path still applies, VDR/VER, evidence, drift, change management, and annual assessment where required. scm.cc does not keep you certified; FedRAMP.gov and your assessor/agency do.

Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.

Technical detail

Cluster pages reuse cadence kinds (rev5_monthly, f20x_quarterly, rev5_annual) as labels for official cadences. Deadlines live on /deadlines. Do not invent a due day — cadence.ts requires a configured dueDayOfMonth.

Related product: Evidence QA (persistent validation evidence). Canonical page https://scm.cc/evidence-qa. scm.cc is not an assessor and grants no authorization.

Ongoing-certification cluster

  1. Continuous Monitoring (stay certified)
  2. Persistent Validation
  3. Evidence Collection (ongoing)
  4. Vulnerability Remediation (ongoing)
  5. Compliance Drift
  6. Change Management (ongoing)
  7. Annual Assessment
  8. Ongoing Certification

Questions teams ask

If I use scm.cc, do I stay certified automatically?
No. Ongoing certification is a FedRAMP/agency obligation. This hub maps the work; it does not perform it.

Related

Primary sources

Last verified 2026-09-27. FedRAMP.gov is authoritative.

Explore the knowledge hub

Learn

Assessor training

Get Certified

Stay Certified

Implementation

Marketplace

Intelligence

Free Tools