CCM-OCR-AVLReport Availability
allMUST
Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information:
Who it binds
Controls whose FedRAMP guidance points at CCM (2)
Their guidance names the Collaborative Continuous Monitoring rules as a whole, not this requirement — so this is where to read from, not a mapping to this clause. Controls no KSI reaches have no page and are not listed.
Which certifications it binds
- Certification type
- 20x · Rev5
- Path
- Program · Agency
Machine-readable form
FedRAMP Ongoing Certification Report (CCM-OCR-AVL)
https://fedramp.gov/schemas/fedramp-ongoing-certification-report-schema-2026-06-24.json
Evidence this requirement demands
- Most recent Ongoing Certification Report. If the report is not available, the provider MUST provide a sample report that includes all required information.
- How the report will be delivered
5 default artifacts owed by every FRR requirement
- Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.
- Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.
- Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.
- Independent verification.
- Independent validation.
Group all, subset OCR of Collaborative Continuous Monitoring. See all obligations on /obligations or the full evidence plan on /evidence.