This is the third cluster of the 124 CSP requirements behind FedRAMP 20X — the requirements that govern how your authorization data and ongoing posture are published to and reviewed by federal agencies:
- Authorization Data Sharing (ADS) — 9 direct CSP requirements + 7 trust-center requirements*
- Collaborative Continuous Monitoring (CCM) — 17 CSP requirements
33 CSP requirements total. ADS handles the static layer — what's published, in what format, with what retention. CCM handles the dynamic layer — the recurring quarterly cadence of reports and live agency engagement.
* The 7 Trust Center requirements technically apply to the trust center itself, but they're effectively CSP responsibilities. ADS-CSX-UTC requires CSPs to use a FedRAMP-compatible trust center, and the 7 Trust Center requirements are what define "FedRAMP-compatible." If you self-host your trust center, those 7 are your direct responsibility. If you use a third party, you're still on the hook for ensuring the platform meets them.
For the full breakdown of the 124, start with the pillar post: FedRAMP 20X: Why 60 KSIs Actually Mean 124 Requirements for Cloud Service Providers.
Authorization Data Sharing (ADS): 9 CSP requirements + 7 trust-center requirements
ADS says: your authorization data must be published, in defined formats, through a defined channel, with defined retention. In practice, this means operating a trust center — a public-facing surface where agencies and other stakeholders can view your current FedRAMP 20X status, the underlying KSI evidence, and the supporting documentation that backs it up.
A few specifics that distinguish ADS from a typical commercial trust center:
Both human- and machine-readable formats
A traditional commercial trust center is built for human consumption — a clean web UI showing your certifications, with downloadable PDFs. ADS expects that, plus a machine-readable layer (OSCAL-aligned or otherwise structured) that automated agency tools can ingest.
A 3-year historical retention floor
Authorization data isn't just "what's true now." Historical versions must be available for at least three years, so agencies can see how your posture evolved across changes, incidents, and re-authorizations.
Direct integration with KSI evidence
ADS doesn't just publish a certificate. It publishes the underlying KSI implementation summaries, the validation status, the vulnerability backlog, and the change log. The trust center becomes the primary delivery mechanism for the work your PVA engine produces.
Practical guidance: Treat the trust center as a product, not a webpage. Wire it directly into your validation engine — the same PVA pipeline that produces your internal KSI status should feed directly into the trust center publication layer. This eliminates the gap between "what we know internally" and "what's published externally."
Collaborative Continuous Monitoring (CCM): 17 CSP requirements
CCM defines the recurring engagement cadence between you, FedRAMP, and your agency customers. With 17 CSP requirements, it's the second-largest single requirement set in the framework after VDR.
CCM has two main pieces:
The quarterly Ongoing Authorization Report (OAR)
Every three months, you deliver an OAR summarizing how your security posture has evolved since the last report. The OAR covers changes to the service since the last reporting period, accepted vulnerabilities still in the backlog with rationale and remediation timelines, and transformative changes that have meaningfully altered the system architecture or scope.
The OAR is structured, not narrative. It's expected to integrate with the same machine-readable layer that ADS publishes, so agencies can consume reporting at scale rather than reading dozens of bespoke documents.
Synchronous Quarterly Review (Moderate and High)
For Moderate and High impact authorizations, the OAR is paired with a synchronous Quarterly Review — a live session, open to agency customers, where the report is walked through, questions are answered, and the conversation about the service's evolving posture happens in real time.
This is a recurring meeting on the calendar, every quarter, that your team has to staff and prepare for. The Quarterly Review formalizes the agency-CSP relationship as ongoing collaboration rather than periodic audit. For Low impact authorizations, the synchronous review is generally not required, but the OAR cadence still applies.
Practical guidance: Standardize the OAR format early. Producing the OAR is much easier when the underlying data sources are structured and consistent. For the Quarterly Review, treat it like a recurring product demo, not an audit — teams that prepare for it like a regular customer business review tend to build stronger agency relationships.
How ADS and CCM work together
Together, ADS and CCM replace the legacy model of "annual assessment + monthly POA&M paperwork" with something closer to "continuously published evidence + quarterly structured engagement." The cadence is faster, the formats are richer, and the agency relationship is more interactive.
A practical effect worth noting: the quarterly cadence becomes a forcing function for the rest of your program. A quarterly review on the calendar surfaces issues — drifted KSIs, slipping remediation timelines, undocumented changes — earlier than they'd otherwise become visible. Teams that lean into the cadence often find their internal security operations get sharper because of it.
What's next
The fourth and final cluster covers the time-sensitive communication channels you operate with FedRAMP and agencies: the FedRAMP Security Inbox (FSI), Incident Communications Procedures (ICP), and Significant Change Notifications (SCN) — 33 CSP requirements that handle 12-hour response times, 1-hour incident reports, and structured change notification cycles.