Evidence on a schedule
Automated evidence collection, kept with timestamps.
Every framework's clock, one record
Each framework sets its own monitoring rhythm: quarterly reports for FedRAMP, monthly scans for GovRAMP, annual affirmations for CMMC, ongoing authorization for FISMA. NISTcompliance.ai runs all of them from one evidence record, so the same finding never has to be documented twice.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
Cadence
What each framework expects
Swipe to see every column
| Framework | Recurring obligation | Source |
|---|---|---|
| FedRAMP 20x and Rev5 | Ongoing Certification Report every 3 months (existing Rev5 offerings should adopt by Apr 2, 2027 and must by Oct 1, 2027); monthly human-readable VER report for Rev5 and 20x Classes B to D | CCM, VER rules |
| GovRAMP | Monthly executive summary, POA&M update and vulnerability scans; annual 3PAO testing of about one-third of controls | SAF v4.2 |
| CMMC | Level 1: annual self-assessment and affirmation. Levels 2 and 3: annual affirmation and reassessment every 3 years | 32 CFR Part 170 |
| FISMA and RMF | Ongoing authorization supported by continuous monitoring; annual independent evaluation | OMB A-130, FISMA |
| Department of War (DoD) Impact Levels | Monthly continuous monitoring (vulnerability scans and POA&M) and an annual assessment under the DISA Provisional Authorization | DoD Cloud Authorization Process |
Sources: CCM rules, GovRAMP SAF v4.2, 32 CFR Part 170, OMB Circular A-130, GAO audit guide, DoD Cloud Authorization Process. Sources checked Oct 23, 2026. Not a substitute for the official text.
The platform
Collect once, report everywhere
Findings with owners
Vulnerabilities, POA&M items and accepted weaknesses with owners and due dates.
Managed remediation →Framework-ready output
Quarterly, monthly and annual deliverables built from the same record.
Packages →Go deeper
Monitoring guides
Continuous Monitoring for FedRAMP, FISMA and CMMC
How Quzara runs monitoring across frameworks.
Read the guide →Significant Change Notices
When a change needs a notice, and what goes in it.
Read the guide →Book a demo
Stop documenting twice
We will map your current monitoring calendar across every framework you hold.