Staying FedRAMP Certified
Ongoing 20x obligations: CCM / quarterly OCR, Rev5 monthly ConMon while that path still applies, VDR/VER, evidence, drift, change management, and annual assessment where required. scm.cc does not keep you certified; FedRAMP.gov and your assessor/agency do.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Cluster pages reuse cadence kinds (rev5_monthly, f20x_quarterly, rev5_annual) as labels for official cadences. Deadlines live on /deadlines. Do not invent a due day — cadence.ts requires a configured dueDayOfMonth.
Related product: Evidence QA (persistent validation evidence). Canonical page https://scm.cc/evidence-qa. scm.cc is not an assessor and grants no authorization.
Ongoing-certification cluster
Questions teams ask
- If I use scm.cc, do I stay certified automatically?
- No. Ongoing certification is a FedRAMP/agency obligation. This hub maps the work; it does not perform it.
Related hub pages
- stay certified/continuous monitoring
- stay certified/persistent validation
- stay certified/evidence collection
- stay certified/vulnerability remediation
- stay certified/compliance drift
- stay certified/change management
- stay certified/annual assessment
- stay certified/ongoing certification
- continuous monitoring
- vulnerability management
- evidence
- deadlines
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- Collaborative Continuous Monitoring (CCM / Ongoing Certification Report) (retrieved 2026-09-27)
- Vulnerability Detection and Response (VDR/VER) (retrieved 2026-09-27)
- FedRAMP Certification reference (classes, KSI metrics window) (retrieved 2026-09-27)
- FedRAMP path & transition deadlines (retrieved 2026-10-11)
Last verified 2026-09-27. FedRAMP.gov is authoritative.