continuous-monitoring.xml 1 2027-01-04T08:00:00 08:00:00 17:00:00 480 2400 20 7 1 1 Standard 1 -1 1 0 2 1 08:00:0012:00:00 13:00:0017:00:00 3 1 08:00:0012:00:00 13:00:0017:00:00 4 1 08:00:0012:00:00 13:00:0017:00:00 5 1 08:00:0012:00:00 13:00:0017:00:00 6 1 08:00:0012:00:00 13:00:0017:00:00 7 0 1 1 Phase 0 — Charter and alignment 1 1

1

2027-01-04T08:00:00 2027-01-29T17:00:00 2 2 X-P02 Platform host built and repository seeded 1.1 2 2027-01-15T17:00:00 2027-01-15T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The contract has no record to be committed to; Gate 1 waits Source: ../books/b13-governance/03-one-authoritative-record.md#where-the-record-lives 4 2027-01-15T17:00:00 3 3 X-G0 Program G0: Ready to Plan 1.2 2 2027-01-29T17:00:00 2027-01-29T17:00:00 PT0H0M0S 7 1 Steward (backup: executive sponsor; program) Owner or approver: Steward (backup: executive sponsor; program) If decided late: This plan's Gate 0 should land before it; the pilot scope feeds the program's planning Source: ../books/b00-orientation/06-the-project-portfolio.md#how-the-projects-fit-the-program 4 2027-01-29T17:00:00 4 4 M0.1 Sponsor, lead and the four domain leads named 1.3 2 2027-01-04T08:00:00 2027-01-06T17:00:00 PT24H0M0S 7 0 Executive sponsor and CIO Owner or approver: Executive sponsor and CIO Source: ../books/b13-governance/12-governance-at-scale.md#phases-and-success-measures 5 5 D-M1 Where the record, schemas, rules and their code live 1.4 2 2027-01-06T17:00:00 2027-01-06T17:00:00 PT0H0M0S 7 1 Program office (steward) Owner or approver: Program office (steward) Options: One repository and one merge gate for the record, schemas, runtime code and tests; several repositories If decided late: The contract can't be committed; a whole class of drift between the record and the code that reads it stays possible Source: ../books/b13-governance/12-governance-at-scale.md#one-repository-one-merge-gate 4 1 0 7 6 6 M0.2 Record shape, pilot sources and naming-plane join key confirmed 1.5 2 2027-01-07T08:00:00 2027-01-13T17:00:00 PT40H0M0S 7 0 Program office Owner or approver: Program office Source: ../books/b13-governance/12-governance-at-scale.md#phases-and-success-measures 4 1 0 7 7 7 D-M2 Pilot scope: the two emitting sources and the drift object class 1.6 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Options: Two of the identity, endpoint, network and data-platform sources; identity attributes or device posture as the object class If decided late: Emission and the drift loop can't be scoped; every later phase waits Source: ../books/b13-governance/12-governance-at-scale.md#objectives-and-scope 6 1 0 7 8 8 M0.3 Continuous monitoring strategy drafted, with minimum frequencies and manual assessment of what tools can't see 1.7 2 2027-01-07T08:00:00 2027-01-20T17:00:00 PT80H0M0S 7 0 CISO Owner or approver: CISO Source: ../books/b13-governance/09-who-governs.md#where-the-roles-come-from 4 1 0 7 9 9 MG0 Gate 0 — Pilot scope agreed 1.8 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Sponsor, lead and domain leads named; record shape, pilot sources and join key confirmed; pilot scope agreed Source: ../books/b13-governance/12-governance-at-scale.md#phases-and-success-measures 6 1 0 7 5 1 0 7 7 1 0 7 10 10 Phase 1 — Evidence contract 2 1

1

2027-01-14T08:00:00 2027-01-27T17:00:00 11 11 M1.1 Normalized record documented: asset identity, time, control, verdict, evidence reference 2.1 2 2027-01-14T08:00:00 2027-01-20T17:00:00 PT40H0M0S 7 0 Evidence contract lead Owner or approver: Evidence contract lead Source: ../books/b15-day2-operations/11-attestation-and-the-compliance-app.md#one-record-every-source 9 1 0 7 12 12 M1.2 Provenance envelope fixed: source classification, transformation chain, lineage hash 2.2 2 2027-01-18T08:00:00 2027-01-21T17:00:00 PT32H0M0S 7 0 Evidence contract lead Owner or approver: Evidence contract lead Source: ../books/b13-governance/07-evidence-over-attestation.md#the-provenance-envelope 11 3 9600 7 13 13 D-M3 Severity thresholds and halt triggers for the drift classifier 2.3 2 2027-01-13T17:00:00 2027-01-13T17:00:00 PT0H0M0S 7 1 Steward, after board review and an outside reviewer Owner or approver: Steward, after board review and an outside reviewer Options: The default rule (severity from drift class and whether the claim is in active use; P1 halts and is never remediated automatically); a severity pinned by the owning book's check If decided late: The remediation contract has no severity or window, and can't be published Source: ../books/b13-governance/09-who-governs.md#who-approves-rule-changes 9 1 0 7 14 14 M1.3 Remediation contract shape: class, severity, record version, ladder ceiling, named escalation role 2.4 2 2027-01-21T08:00:00 2027-01-25T17:00:00 PT24H0M0S 7 0 Drift detection lead Owner or approver: Drift detection lead Source: ../books/b13-governance/06-the-drift-engine.md#the-remediation-contract 11 1 0 7 13 1 0 7 15 15 M1.4 Contract committed to the record by reviewed pull request, with a decision record 2.5 2 2027-01-26T08:00:00 2027-01-27T17:00:00 PT16H0M0S 7 0 Steward Owner or approver: Steward Source: ../books/b13-governance/04-change-control-and-provenance.md#changing-the-record-pull-requests 12 1 0 7 14 1 0 7 2 1 0 7 16 16 MG1 Gate 1 — Evidence contract published 2.6 2 2027-01-27T17:00:00 2027-01-27T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: The normalized record and its binding to controls are documented; the contract is published and versioned in the authoritative record Source: ../books/b13-governance/12-governance-at-scale.md#phases-and-success-measures 15 1 0 7 17 17 Phase 2 — Emission 3 1

1

2027-01-14T08:00:00 2027-02-08T17:00:00 18 18 M2.1 Read-only identity adapter declared: class, mission, pinned API version, permissions 3.1 2 2027-01-14T08:00:00 2027-01-20T17:00:00 PT40H0M0S 7 0 Platform teams Owner or approver: Platform teams Source: ../books/b13-governance/08-the-adapter-model.md#the-contract 9 1 0 7 19 19 M2.2 Read-only device-posture adapter declared 3.2 2 2027-01-14T08:00:00 2027-01-20T17:00:00 PT40H0M0S 7 0 Platform teams Owner or approver: Platform teams Source: ../books/b13-governance/08-the-adapter-model.md#the-contract 9 1 0 7 20 20 M2.3 Both adapters earn active status: recorded fixtures, live non-production tenant, reference deployment in the boundary 3.3 2 2027-01-28T08:00:00 2027-02-04T17:00:00 PT48H0M0S 7 0 Platform teams Owner or approver: Platform teams Source: ../books/b13-governance/08-the-adapter-model.md#earning-active-status-and-retiring 18 1 0 7 19 1 0 7 16 1 0 7 21 21 M2.4 Each adapter's granted permissions compared with its declaration 3.4 2 2027-02-05T08:00:00 2027-02-08T17:00:00 PT16H0M0S 7 0 CISO's staff Owner or approver: CISO's staff Source: ../books/b13-governance/08-the-adapter-model.md#read-only-first 20 1 0 7 22 22 M2.5 Telemetry-completeness check scheduled for each source 3.5 2 2027-02-02T08:00:00 2027-02-04T17:00:00 PT24H0M0S 7 0 Security operations Owner or approver: Security operations Source: ../books/b15-day2-operations/12-the-day-two-runbook.md#the-telemetry-completeness-check 20 3 14400 7 23 23 MG2 Gate 2 — Two sources emitting 3.6 2 2027-02-08T17:00:00 2027-02-08T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Two sources emitting normalized records on their own cadence; each adapter holds no more than its declaration; a silent source raises an alert Source: ../books/b13-governance/12-governance-at-scale.md#phases-and-success-measures 21 1 0 7 22 1 0 7 24 24 Phase 3 — Aggregation 4 1

1

2027-02-09T08:00:00 2027-02-18T17:00:00 25 25 M3.1 Records joined on the naming-plane identity plus time for the pilot scope 4.1 2 2027-02-09T08:00:00 2027-02-15T17:00:00 PT40H0M0S 7 0 Aggregation lead Owner or approver: Aggregation lead Source: ../books/b15-day2-operations/07-the-cmdb-and-asset-identity.md#the-join-key-identity-plus-time 23 1 0 7 26 26 M3.2 Unjoinable records counted and reported as a coverage gap 4.2 2 2027-02-16T08:00:00 2027-02-18T17:00:00 PT24H0M0S 7 0 Aggregation lead Owner or approver: Aggregation lead Source: ../books/b13-governance/12-governance-at-scale.md#risks-and-assumptions 25 1 0 7 27 27 M3.3 CMDB reconciliation rule applied; unmatched assets worked in the exception queue 4.3 2 2027-02-11T08:00:00 2027-02-17T17:00:00 PT40H0M0S 7 0 CMDB owner Owner or approver: CMDB owner Source: ../books/b15-day2-operations/07-the-cmdb-and-asset-identity.md#how-the-platform-reconciles-and-what-the-program-adds 25 3 9600 7 28 28 MG3 Gate 3 — One reconciled picture 4.4 2 2027-02-18T17:00:00 2027-02-18T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: One reconciled picture for the pilot scope, joined on asset identity, with unjoinable records counted, not dropped Source: ../books/b13-governance/12-governance-at-scale.md#phases-and-success-measures 26 1 0 7 27 1 0 7 29 29 Phase 4 — Detection and assembly 5 1

1

2027-01-26T08:00:00 2027-03-08T17:00:00 30 30 X-P12 Enterprise groups and administrative units built 5.1 2 2027-02-17T17:00:00 2027-02-17T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: There is nothing to drift-check before G1; the drift run moves day for day Source: ../books/b13-governance/06-the-drift-engine.md#one-model-many-domain-checks 4 2027-02-17T17:00:00 31 31 M4.1 Pilot groups and administrative units checked against the record; findings written in contract shape 5.2 2 2027-02-18T08:00:00 2027-02-22T17:00:00 PT24H0M0S 7 0 Drift detection lead Owner or approver: Drift detection lead Source: ../books/b13-governance/06-the-drift-engine.md#what-is-built-today 30 1 0 7 23 1 0 7 14 1 0 7 32 32 X-G1 Program G1: Foundation Complete (groups and AUs drift-clean) 5.3 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Steward (program) Owner or approver: Steward (program) If decided late: M4.1 must finish before it, or G1's drift-clean criterion rests on findings recorded by hand Source: ../books/b13-governance/12-governance-at-scale.md#the-continuous-monitoring-program-as-a-project 4 2027-02-26T17:00:00 31 1 0 7 33 33 D-M4 Actuation ceiling for each pilot operation class 5.4 2 2027-01-25T17:00:00 2027-01-25T17:00:00 PT0H0M0S 7 1 Authorizing official Owner or approver: Authorizing official Options: Every class at L3 gated actuation, the default; a named low-blast-radius class at L4 under written conditions, such as re-applying a dynamic membership rule from the registry If decided late: The loop's remediate step can't be configured; the drift loop waits Source: ../books/b13-governance/10-ticket-to-machine.md#approval-gates-keep-humans-on-the-decisions-that-matter 14 1 0 7 34 34 M4.2 Drift loop for identity attributes end to end: snapshot, compare, classify, alert, remediate, verify 5.5 2 2027-02-23T08:00:00 2027-03-08T17:00:00 PT80H0M0S 7 0 Drift detection lead Owner or approver: Drift detection lead Source: ../books/b13-governance/06-the-drift-engine.md#what-the-engine-remediates-and-what-it-doesnt 31 1 0 7 33 1 0 7 28 1 0 7 35 35 D-M5 Engine that realizes the evidence contract and emits the package 5.6 2 2027-01-27T17:00:00 2027-01-27T17:00:00 PT0H0M0S 7 1 Program office (steward) Owner or approver: Program office (steward) Options: A purpose-built governance platform; a commercial governance, risk and compliance product (buy the native applications first, build only the gaps); native OSCAL tooling If decided late: Package artifacts can't be generated; Gate 4 waits Source: ../books/b15-day2-operations/11-attestation-and-the-compliance-app.md#build-buy-or-both 16 1 0 7 36 36 M4.3 Package artifacts generated from the stream for the pilot: SSP, assessment plan, results, POA&M in OSCAL 5.7 2 2027-02-19T08:00:00 2027-03-04T17:00:00 PT80H0M0S 7 0 Authorization package lead Owner or approver: Authorization package lead Source: ../books/b14-compliance/11-the-authorization-package.md#one-oscal-model-per-artifact 35 1 0 7 28 1 0 7 37 37 M4.4 Coverage classified per control; gap closure register opened; proven and asserted counted 5.8 2 2027-02-26T08:00:00 2027-03-04T17:00:00 PT40H0M0S 7 0 Authorization package lead Owner or approver: Authorization package lead Source: ../books/b13-governance/12-governance-at-scale.md#classify-coverage 26 1 0 7 36 3 24000 7 38 38 MG4 Gate 4 — Drift loop running; package from the stream 5.9 2 2027-03-08T17:00:00 2027-03-08T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Drift loop running for one class; package artifacts generated for the pilot; coverage report separates proven from asserted claims Source: ../books/b13-governance/12-governance-at-scale.md#phases-and-success-measures 34 1 0 7 36 1 0 7 37 1 0 7 39 39 Phase 5 — The cadence after cutover 6 1

1

2027-01-21T08:00:00 2027-06-07T17:00:00 40 40 D-M6 Minimum monitoring frequencies in the continuous monitoring strategy 6.1 2 2027-01-20T17:00:00 2027-01-20T17:00:00 PT0H0M0S 7 1 Senior accountable official for risk management Owner or approver: Senior accountable official for risk management Options: The program's cadence as the minimums; agency-set minimums, which the program may exceed but not undercut If decided late: The cadence can't start; Phase 5 waits Source: ../books/b13-governance/09-who-governs.md#the-responsibility-matrix 8 1 0 7 41 41 M5.1 Daily triage, weekly evidence and drift review, and the human-only closure review running 6.2 2 2027-03-09T08:00:00 2027-03-15T17:00:00 PT40H0M0S 7 0 Program office Owner or approver: Program office Source: ../books/b13-governance/09-who-governs.md#cadence 38 1 0 7 40 1 0 7 42 42 M5.2 Months 1 to 3: assessment results and the POA&M regenerated, POA&M reviewed, posture report to the AO 6.3 2 2027-03-09T08:00:00 2027-05-31T17:00:00 PT480H0M0S 7 0 ISSO Owner or approver: ISSO Source: ../books/b14-compliance/11-the-authorization-package.md#the-cadence 41 3 0 7 43 43 X-P23 Pilot devices moved by pattern 6.4 2 2027-03-31T17:00:00 2027-03-31T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: Device-posture findings can't start; the margin to the G2 hold shrinks day for day Source: ../books/b13-governance/06-the-drift-engine.md#cadence 4 2027-03-31T17:00:00 44 44 M5.3 Pilot devices' posture findings written in contract shape, before the program's drift-clean hold 6.5 2 2027-04-01T08:00:00 2027-04-05T17:00:00 PT24H0M0S 7 0 Platform teams Owner or approver: Platform teams Source: ../books/b13-governance/06-the-drift-engine.md#what-is-built-today 43 1 0 7 20 1 0 7 14 1 0 7 45 45 X-HOLD Program drift-clean hold begins (P2.11) 6.6 2 2027-04-09T17:00:00 2027-04-09T17:00:00 PT0H0M0S 7 1 Program office (program) Owner or approver: Program office (program) If decided late: The hold can't be measured from data, so G2 can't pass on evidence Source: ../books/b00-orientation/09-design-pilot-and-rollout.md#gate-g2-pilot-clean 4 2027-04-09T17:00:00 44 1 0 7 46 46 X-G2 Program G2: Pilot Clean (zero drift for the hold period) 6.7 2 2027-04-23T17:00:00 2027-04-23T17:00:00 PT0H0M0S 7 1 Steward and executive sponsor (co-signed; program) Owner or approver: Steward and executive sponsor (co-signed; program) If decided late: M5.3 must finish before the 14-day hold that ends at G2 Source: ../books/b13-governance/12-governance-at-scale.md#the-continuous-monitoring-program-as-a-project 4 2027-04-23T17:00:00 47 47 M5.4 Federal senior information security official named to review each provider's Ongoing Certification Report 6.8 2 2027-03-09T08:00:00 2027-03-11T17:00:00 PT24H0M0S 7 0 CISO Owner or approver: CISO Source: ../books/b14-compliance/11-the-authorization-package.md#what-fedramps-2026-rules-expect 38 1 0 7 48 48 D-M7 How the agency's decision reuses each external service's package 6.9 2 2027-03-08T17:00:00 2027-03-08T17:00:00 PT0H0M0S 7 1 Authorizing official Owner or approver: Authorizing official Options: An ATO for the agency's own system using a FedRAMP Certified offering; an authorization to use for a shared service another federal entity authorized; a joint authorization under CA-6(2) If decided late: The reciprocity records can't be written; Gate 5 waits Source: ../books/b13-governance/11-reciprocity-and-one-authorization.md#one-package-for-a-shared-service 38 1 0 7 49 49 M5.5 Reciprocity record per external service; first Ongoing Certification Report reviewed and recorded 6.10 2 2027-03-12T08:00:00 2027-03-25T17:00:00 PT80H0M0S 7 0 ISSM Owner or approver: ISSM Source: ../books/b13-governance/11-reciprocity-and-one-authorization.md#what-fedramps-2026-rules-add 48 1 0 7 47 1 0 7 50 50 M5.6 Quarterly trend and evidence-quality review, covering the pilot's drift-clean hold 6.11 2 2027-06-01T08:00:00 2027-06-07T17:00:00 PT40H0M0S 7 0 ISSM Owner or approver: ISSM Source: ../books/b15-day2-operations/12-the-day-two-runbook.md#weekly-monthly-and-quarterly 42 1 0 7 44 1 0 7 46 1 0 7 51 51 MG5 Gate 5 — First quarter of the cadence closed from the stream 6.12 2 2027-06-07T17:00:00 2027-06-07T17:00:00 PT0H0M0S 7 1 Authorizing official Owner or approver: Authorizing official Criteria: Three monthly regenerations from current evidence; every failing item open, excepted with an expiry or reverted to open; each provider report has a named reviewer and a record of review; controls tools can't monitor have a manual assessment at a stated frequency Source: ../books/b14-compliance/11-the-authorization-package.md#what-the-authorizing-official-should-find 49 1 0 7 50 1 0 7