Continuous Monitoring (FedRAMP ConMon)

FedRAMP Continuous Monitoring requires cloud service providers and agencies to produce monthly deliverables demonstrating their security posture. Infracast automates the entire workflow — from daily evidence collection to monthly package assembly.

What ConMon Requires

FedRAMP ConMon mandates:

1. Monthly POA&M updates — Status of every open weakness
2. Monthly scan results — Vulnerability and configuration assessment outputs
3. Significant change notifications — When architecture changes require SSP updates
4. Annual 3PAO assessments — Comprehensive review by an independent assessor
5. Deviation requests — Formal requests when a control cannot be fully met

Without automation, this is 2–5 days of manual effort per month. Infracast handles it continuously.

Authorization Dashboard

The Authorization Status page (/authorization) provides a real-time posture view:

Control Posture

Controls Fully Implemented:     342 / 350  (97.7%)
Controls Partially Implemented:   6 / 350   (1.7%)
Controls Not Implemented:         2 / 350   (0.6%)

Per-control-family breakdown with drill-down to individual controls, trend charts, and last-assessed timestamps.

Drift Alerts

Real-time alerts when a compliant control degrades:

⚠️  Control AC-6 drifted to PARTIAL (2026-04-15 14:23 UTC)
    Cause: New IAM role with wildcard permissions
    Finding: CRIT-2847 — prod-deploy-role
    Action: Review before next ConMon package

Executive AO Summary

One-page authorization confidence report downloadable as a signed PDF — designed for the Authorizing Official.

Monthly ConMon Package

Infracast assembles the complete monthly ConMon package automatically:

File	Content
poam-YYYY-MM.xlsx	POA&M update (FedRAMP template)
scan-results-YYYY-MM.pdf	Signed discovery + compliance summary
evidence-bundle-YYYY-MM.zip	All signed evidence artifacts
significant-changes-YYYY-MM.pdf	Change log (if applicable)
manifest.json	SHA-256 checksums + chain-of-custody
manifest.sig	Ed25519 signature over the manifest

# Generate the monthly package via API
POST /api/v1/tenants/{tenantID}/conmon/monthly
{ "period": "2026-04" }   # defaults to the current month if omitted

Generated packages are listed by GET /api/v1/tenants/{tenantID}/conmon/history. Download the package file from the Continuous Monitoring page in the UI.

Significant Change Detection

Infracast automatically detects FedRAMP-reportable changes between discovery runs:

Change Type	Action Required
New public-facing component	SSP boundary update + FedRAMP notification
New cloud region or VPC	SSP boundary update
New external service dependency	SSP boundary update
Encryption disabled on data store	Immediate POA&M + deviation request
New privileged IAM role	Control re-assessment (AC-2, AC-6)

Detected changes appear in the significant change log and are included in the monthly ConMon package.

GET  /api/v1/tenants/{tenantID}/conmon/changes
POST /api/v1/tenants/{tenantID}/conmon/changes/{id}/acknowledge

3PAO Evidence Bundles

For annual assessments, generate a comprehensive 3PAO bundle:

# CLI
infracast conmon bundle \
  --tenant acme-corp \
  --from 2026-01-01 \
  --to 2026-04-15 \
  --output 3pao-bundle-q1-2026.zip

# API
POST /api/v1/tenants/{tenantID}/conmon/bundle
{ "from": "2026-01-01", "to": "2026-04-15" }

The bundle includes all evidence artifacts, full POA&M history, significant change log, discovery scan results, and a VERIFICATION.md with signature verification instructions for the assessor.

cATO / Ongoing Authorization

For programs operating under DoD cATO frameworks:

• Live authorization dashboard satisfies real-time visibility requirements
• Automated daily evidence generation replaces periodic snapshots
• Drift alerts provide immediate notification when posture degrades
• AO summary report provides current posture view on demand

API Reference

# Current ConMon posture summary
GET /api/v1/tenants/{tenantID}/conmon/summary

# Package history
GET /api/v1/tenants/{tenantID}/conmon/history

# Generate this month's package, or an ad-hoc bundle
POST /api/v1/tenants/{tenantID}/conmon/monthly
POST /api/v1/tenants/{tenantID}/conmon/bundle

# Significant changes, and acknowledging one
GET  /api/v1/tenants/{tenantID}/conmon/changes
POST /api/v1/tenants/{tenantID}/conmon/changes/{id}/acknowledge

API paths corrected 2026-09-14

This page previously documented /conmon/status, /conmon/packages, /conmon/significant-changes and a package download path. None of those routes exist — those calls returned 404. The verified equivalents are /conmon/summary, /conmon/history and /conmon/changes.

Related Features

• Evidence Engine — ConMon packages consume evidence artifacts
• POA&M Management — Monthly POA&M update is a core ConMon deliverable
• GRC Integrations — ConMon data feeds to eMASS and CSAM

Availability

Tier	Access
Free / Pro / Business / Enterprise	Not available
Enterprise Pro	ConMon automation, significant change detection
Gov / Federal	Full ConMon + CSAM auto-submit + 3PAO bundles