CCM-QTR-MTGQuarterly Review Meeting
allvaries by class: a, b, c, d
The statement for this requirement varies by certification class — see the per-class deadlines below.
Who it binds
Controls whose FedRAMP guidance points at CCM (2)
Their guidance names the Collaborative Continuous Monitoring rules as a whole, not this requirement — so this is where to read from, not a mapping to this clause. Controls no KSI reaches have no page and are not listed.
Deadlines (4)
| Class | Timeframe | Statement |
|---|---|---|
| A | 3 months | Providers with Class A Certifications MAY host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies. |
| B | 3 months | Providers with Class B Certifications SHOULD host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies. |
| C | 3 months | Providers with Class C Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies. |
| D | 3 months | Providers with Class D Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies. |
Which certifications it binds
- Certification type
- 20x · Rev5
- Path
- Program · Agency
Evidence this requirement demands
- selected ordinal recurrence for the synchronous Quarterly Review cycle if applicable.class a
- selected ordinal recurrence for the Ongoing Certification Report cycle if applicable OR explanation for why Ongoing Certification Reports are not being delivered.class b
- selected ordinal recurrence for the Ongoing Certification Report cycle.class c
- selected ordinal recurrence for the Ongoing Certification Report cycle.class d
5 default artifacts owed by every FRR requirement
- Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.
- Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.
- Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.
- Independent verification.
- Independent validation.
Group all, subset QTR of Collaborative Continuous Monitoring. See all obligations on /obligations or the full evidence plan on /evidence.