FedRAMP Topic

FG-04 Continuous Monitoring Operations

Run recurring security monitoring with consistent reporting discipline.

Implementation Actions

  • Define monthly and periodic monitoring schedule.
  • Run vulnerability scans and triage workflows with SLA targets.
  • Track and escalate overdue high-risk items.

Evidence Examples

  • Continuous monitoring schedule
  • Scan and triage reports
  • Escalation logs

Suggested Metrics

  • Monitoring task completion rate
  • Critical remediation SLA attainment