ConMon Observation period

[brandenc-xai]

We're preparing for a Rev5 Class D FedRAMP certification and have a question about continuous monitoring for an initial authorization. Is an observation period required? Specifically, could our independent assessor verify that our continuous monitoring process is in place and the tools are configured correctly, instead of us showing evidence of it running over a set period? Assessors have told us a 60 to 90 day period is needed, but we haven't been able to find where that requirement is written.

[pete-gov]

Assessors have told us a 60 to 90 day period is needed, but we haven't been able to find where that requirement is written.

If an assessor cites a rule or requirement to you but can't show you where that rule is written down officially then that might be a red flag. Historically there were "ghost rules" that assessors learned from bad experiences with FedRAMP and piled on, but we have been quite clear over the past two years that it doesn't work like that anymore.

Ask them where this requirement originates from. I'm betting they are referencing old vuln scanning guidance that recommended checking vuln scans in advance of the SAR or something weird like that? Alternatively it may be a requirement from your agency sponsor, or something you agreed to with them, etc.

There is no current FedRAMP rule requiring 90 days of conmon data to be reviewed during assessment, though it's a value add if you have it and can do it.

[jsantore-sf]

I was a 3PAO in a former life, and I thought would be helpful to add some historical context to this. This wasn't a 'ghost rule' per se, it was a natural consequence of an strict Federal mandate requirement.

There were 6 mandates, all published primarily in the RAR (but they weren't arbitrary or secret, and I concur it's weird that the RAR was the main location for listing these). Those 6 were, paraphrased:

1. Must have FIPS encryption
2. Must have MFA (technically Digital Identity Level 2 for Mod, 3 for High)
3. Must accept CAC/PIV cards (usually done through SAML)
4. Federal records requirements, originally NARA, eventually sort of superceded by M-21-31 (and then M-26-14)
5. Must have DNSSEC in place (SC-20/SC-21)
6. Does the CSP have the ability to consistently remediate vulnerabilities within 30/90/180 days. THIS is the one that is relevant to the historical conmon data issue.

In order to determine if someone is consistently remediating vulnerabilies, you need enough of a history to show that any high vulns were addressed in a timely fashion. That's where the 'we need 60-90 days of conmon data' came from. When I was assessing a system, my requirement was not necessarily a hard and fast 60-90 days, but sufficient history and/or enough vuln scan cycles to be able to determine that this was consistently addressed. Regardless, one cannot evaluate this requirement as a simple point in time check; it de facto needs history.

Remember that these were deemed to be Federal mandates (alas I don't remember what the genesis of their authority was, possibly the JAB), but it was consistently applied. Whether or not these mandates truly had a statutory basis, I don't recall, but these were some of the clearest requirements of FedRAMP.

@pete-gov "we have been quite clear over the past two years that it doesn't work like that anymore."

Agreed, and this is one of the best things of the new FedRAMP program. Just a word of caution that while something may not be a firm black letter rule, sometimes a necessary consequence of evaluating or satisfying that rule (i.e. vulnerability history in this case) has some required-but-unwritten aspect of it.