FedRAMP Tailored Low Impact Software as a Service (LI-SaaS) Continuous Monitoring Guide - Version 2.0 - Overview

Sep 1, 2026

Upload by Aria

FedRAMP Tailored Low Impact Software as a Service (LI-SaaS) Continuous Monitoring Guide defines how continuous monitoring and ongoing authorization support ongoing risk management after initial authorization. It aligns with OMB Circular A-130 Appendix I and NIST SP 800-137, explaining how Authorizing Officials use sufficient security-state information to decide whether continued operation remains acceptable. The guide sets minimum strategy and requirements for CSPs to monitor security posture changes, conduct ongoing assessment activities, and manage controls, incidents, and change control to sustain FedRAMP Tailored LI-SaaS compliance.

LanguageEnglish

CategoryGeneral

FormatDOCX

Pages19

Reading Time7 min

AccessFree to download

Overview

Purpose of This Document

Continuous Monitoring Process

Continuous Monitoring Roles And Responsibilities

Authorizing Official

FedRAMP PMO

Department of Homeland Security (DHS)

Independent Security Assessment

FedRAMP Tailored LI-SaaS CSP

Continuous Monitoring Process

Operational Visibility

Ongoing Continuous Monitoring Requirements

Annual Continuous Monitoring Requirements

Change Control

Incident Response

Authorizing Official (AO) Continuous Monitoring Analysis Process

Appendix A - Control Frequencies

FedRAMP Tailored Low Impact Software as a Service (LI-SaaS) Continuous Monitoring Guide Federal Risk and Authorization Management Program Version 2.0 August 23, 2017 Executive Summary The Office of Management (OMB) Circular No. A-130, Appendix I (OMB A-130), issued July 28, 2016, requires the implementation of continuous monitoring (ConMon) as a means for maintaining ongoing awareness of the information security, vulnerabilities, threats, and incidents to support the agency risk management decisions. OMB A-130 defines “ongoing authorization” as “the means for determining risk and for making risk acceptance decision subsequent to the initial authorization, taken at agreed-upon and documented frequencies in accordance with the agency’s mission or business requirements and agency risk tolerance.” OMB A-130 further defines ongoing authorization as a time-driven or event-driven authorization process whereby the Authorizing Official (AO) is provided with the necessary and sufficient information regarding the security state of the information system to determine whether the mission or business risk of continued system operation is acceptable. Consistent with OMB A-130 and in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations, FedRAMP developed an ongoing assessment and authorization program for the purpose of maintaining the authorization of FedRAMP Tailored Low Impact Software as a Service (LI-SaaS) Cloud Service Providers (CSP). This continuous monitoring guide describes the FedRAMP strategy and minimum requirements for a CSP to use once it has received a FedRAMP Authorization based on the FedRAMP Tailored LI-SaaS requirements. CSPs must continuously monitor the cloud service offering to detect changes in the security posture of the system to enable well-informed risk-based decision making. Document Revision History Table of Contents TOC \o "1-3" \h \z \u HYPERLINK \l "_Toc490669230" 1. Overview PAGEREF _Toc490669230 \h 1 HYPERLINK \l "_Toc490669231" 1.1. Purpose of This Document PAGEREF _Toc490669231 \h 2 HYPERLINK \l "_Toc490669232" 1.2. Continuous Monitoring Process PAGEREF _Toc490669232 \h 2 HYPERLINK \l "_Toc490669233" 2. Continuous Monitoring Roles And Responsibilities PAGEREF _Toc490669233 \h 4 HYPERLINK \l "_Toc490669234" 2.1. Authorizing Official PAGEREF _Toc490669234 \h 4 HYPERLINK \l "_Toc490669235" 2.2. FedRAMP PMO PAGEREF _Toc490669235 \h 4 HYPERLINK \l "_Toc490669236" 2.3. Department of homeland security (DHS) PAGEREF _Toc490669236 \h 4 HYPERLINK \l "_Toc490669237" 2.4. Independent Security Assessment PAGEREF _Toc490669237 \h 5 HYPERLINK \l "_Toc490669238" 2.5. FedRAMP Tailored LI-SaaS CSP PAGEREF _Toc490669238 \h 5 HYPERLINK \l "_Toc490669239" 3. Continuous Monitoring Process PAGEREF _Toc490669239 \h 6 HYPERLINK \l "_Toc490669240" 3.1. Operational Visibility PAGEREF _Toc490669240 \h 6 HYPERLINK \l "_Toc490669241" 3.2. Ongoing Continuous Monitoring Requirements PAGEREF _Toc490669241 \h 6 HYPERLINK \l "_Toc490669242" 3.3. Annual Continuous Monitoring Requirements PAGEREF _Toc490669242 \h 7 HYPERLINK \l "_Toc490669243" 3.4. Change Control PAGEREF _Toc490669243 \h 8 HYPERLINK \l "_Toc490669244" 3.5. Incident Response PAGEREF _Toc490669244 \h 9 HYPERLINK \l "_Toc490669245" 4. Authorizing Official (AO) Continuous Monitoring Analysis Process PAGEREF _Toc490669245 \h 10 HYPERLINK \l "_Toc490669246" 5. Appendix A - Control Frequencies PAGEREF _Toc490669246 \h 11 List of Figures & Tables TOC \f t \h \z \t "Caption,1" \c "Figure" HYPERLINK \l "_Toc490665531" Figure 1 – NIST Special Publication 800-137 ConMon Process PAGEREF _Toc490665531 \h 3 HYPERLINK \l "_Toc490665532" Table 3-1 – Criteria for AO Selection of Additional T

FAQs

What is the purpose of continuous monitoring in the FedRAMP Tailored LI-SaaS context?

Continuous monitoring maintains ongoing awareness of security, vulnerabilities, threats, and incidents so risk-based decisions can be made after initial authorization. It supports maintaining an authorization state that continues to meet FedRAMP Tailored LI-SaaS requirements.

Which standards and authorities does the guide align with?

The guide aligns with OMB Circular No. A-130, Appendix I, and NIST Special Publication 800-137. It also follows the FedRAMP ongoing assessment and authorization program approach for Tailored LI-SaaS.

Who is expected to use the continuous monitoring guide?

Cloud Service Providers (CSPs), Independent Assessors, government contractors on FedRAMP projects, and government employees working on FedRAMP projects should use the guide. Other organizations building a ConMon program may also find it useful.

Sep 1, 2026

Upload by Aria