What does continuous validation mean in FedRAMP 20X?

Continuous validation means proving, on an ongoing basis and mostly through automation, that security measures are in place and working. FedRAMP.gov's rules usually call this "persistent" verification and validation rather than "continuous validation."

The idea behind it

FedRAMP 20x holds that security "should be continuously enforced, monitored, and reported—not staged for a point-in-time audit." FedRAMP defines "persistently" as occurring in a steady way, repeated over a long period. Verification shows a measure is implemented, and validation shows it is effective.

What the rules require

Providers verify and validate Key Security Indicators (KSIs), the 20x security outcomes, with automated methods. This is optional for Class A and recommended for Class B. It is required for Class C (two methods per KSI) and Class D (four methods per KSI).

Timing that applies

A provider's initial certification package must show its status as verified and validated within the previous 7 days. Class B, C and D providers must also complete an independent assessment covering all KSIs at least once a year. Ongoing Certification rules, which replace continuous monitoring, take effect January 1, 2027.

Keeping up in practice

Because certification now reflects a system's current state, any review of gaps also needs to stay current as the system changes. A one-time spreadsheet can go stale quickly. Keeping that view up to date, and sharing current data with agencies, becomes routine work rather than a yearly event.