FedRAMP 20x is the FedRAMP program's current certification path, widely available since June 2026. Its core principles include Automatic Validation - security status, progress, and outcomes validated automatically whenever possible - and clearer, more measurable, more reusable evidence instead of hand-built documents.

What is continuous controls monitoring (ConMon)?

Continuous controls monitoring is the ongoing, automated check that security controls keep working between assessments. scm.cc runs it by pulling findings on a schedule from the scanners a team already uses - AWS Security Hub, Defender for Cloud, GitHub code scanning - into one live FedRAMP posture picture, and by re-validating evidence coverage every month against the pinned previous run.

What is FedRAMP POA&M automation?

POA&M automation turns every open weakness into a Plan of Action & Milestones record without a spreadsheet. In scm.cc, drift and findings roll into a durable POA&M with owners, dates and control mappings, and overdue milestones surface as findings instead of passing silently. POA&M is a Rev5-era work tracker; it is not a 2026/20x monthly deliverable. The monthly 20x item is the human-readable vulnerability activity report (VER-TFR-MHR).

FedRAMP 20x continuous monitoring, without the spreadsheet.

FedRAMP 20x asks for automated validation and reusable evidence. scm.cc already works that way: it connects the scanners you run, validates your posture on a schedule, and pins every monthly run into evidence you can replay, sign off, and hand over.

Create an account See pricing

Automated validation, on a schedule

Findings stream in hourly from your own accounts - AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center, GitHub code scanning, Supabase security advisors - read-only, validated live before anything is stored. Disconnected sources stop counting, so the headline number is always the live one.

Drift that surfaces itself

Each monthly run is re-validated against the pinned previous run. A control that loses evidence coverage becomes a finding and a dashboard alert automatically - and resolves itself the day it is covered again. Overdue policy reviews and plan tests surface the same way; expired risk acceptances reopen on the POA&M.

Reusable evidence, not rebuilt binders

Every monthly run pins its inputs with a tamper-evident hash and replays on demand. The same pinned records assemble the quarterly Ongoing Certification Report draft, a POA&M CSV (a Rev5-era work tracker, not a 2026/20x monthly deliverable), and a downloadable monthly artifact package. The 20x monthly item is the human-readable vulnerability activity report (VER-TFR-MHR).

Sign-off that locks the record

Monthly runs and quarterly reports carry a real sign-off: named signer, timestamp, and a locked record the engine never rewrites. Significant-change evaluations can be recorded alongside (SCN-CSO-EVA). Official 20x notifications also require change type, the ten SCN-CSO-INF fields, and type-specific business-day timelines (SCN-TRF-*, SCN-ADP-NTF); recording a change is not those notification rules.

KSI history, accumulating daily

20x Class C asks for persistent per-KSI verification - two or more automated methods per Key Security Indicator (FRC-CSX-VVK) - and daily metric data including persistent-validation status, up to the past year where available (SDR-CSX-KMT). There is no six-month minimum in the 2026 rules (v2026.10.08.01). scm.cc records each KSI's verification status daily with method provenance. History starts when you connect and cannot be backfilled.

Findings become a POA&M

Open weaknesses roll into a plan of action with owners and dates, mapped to the FedRAMP controls they evidence, with a CSV export. That POA&M is a Rev5-era work tracker; it is not a 2026/20x deliverable (the term does not appear in the Consolidated Rules). The monthly 20x item is the human-readable vulnerability activity report (VER-TFR-MHR).

Shipping an AI feature? Check it against the AI laws

A fixed-scope, fixed-price readiness review against the EU AI Act transparency duties, California AB 2013 and Colorado's automated-decision law. You get written findings and a remediation checklist. It is an engineering gap analysis, not legal advice or a certification.

Read the AI law hub · See the AI regulations readiness review

Learn FedRAMP 20x

Sourced pages on the 20x path, Key Security Indicators, evidence, and official dates. Educational only - scm.cc is not an assessor and does not grant an authorization.

The 20x transition, on official dates

From fedramp.gov, not from us:

FedRAMP 20x has been widely available since June 2026 - the Consolidated Rules for 2026 are in effect for new 20x applications since July 4, 2026.
January 1, 2027: the Consolidated Rules become mandatory - active 20x certifications and new Rev5 applications must adopt them.
June 11, 2027: FedRAMP stops accepting new Rev5 applications.
February 1, 2028: the general grace period ends.

Questions, answered straight

What is FedRAMP 20x?

The program's current certification path, widely available since June 2026. Its core principles include Automatic Validation - security status and outcomes validated automatically whenever possible - and clearer, more measurable, more reusable evidence. That is the shape scm.cc was built around.

What does scm.cc actually do today?

Hourly connector syncs, monthly sealed ConMon runs with replayable pinned evidence, drift alerts, a durable POA&M with CSV export (Rev5-era work tracker, not the 20x monthly deliverable), quarterly OCR drafts covering the CCM-mandated sections, sign-off locks, significant-change evaluation records (SCN-CSO-EVA), and daily per-KSI verification history (SDR-CSX-KMT). What it is not: a 3PAO - it does not perform independent assessments or grant an authorization. Tracking a change is not SCN-CSO-INF, SCN-TRF-*, or SCN-ADP-NTF compliance.

What does ConMon without spreadsheets mean?

Monthly evidence and POA&M work-tracker records live in one system. Each monthly run is pinned to package, baseline and template versions with an immutable receipt, so the quarterly package is assembled from real records instead of rebuilt by hand. The 20x monthly customer-facing deliverable is VER-TFR-MHR, not a POA&M CSV.

Connectors: AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center, GitHub code scanning, Supabase security advisors - read-only, validated live before anything is stored.