CCM-QTR-SARSHOULDAll frameworksImplementation guide coming soon

Schedule Around Reports

Collaborative Continuous Monitoring (CCM) · Quarterly Reviews

Applies to: Providers

Who this applies to: Providers
Service class: All service classes
Force: SHOULD
Timeframe: No fixed timeframe

Reviewed implementation guidance for CCM-QTR-SAR is not published yet. The official source below remains complete and authoritative.

Official FedRAMP source

Verbatim from FedRAMP/rules

Providers SHOULD regularly schedule Quarterly Reviews to occur at least 3 business days after releasing an Ongoing Certification Report AND within 10 business days of such release.

Defined terms in this requirement

FedRAMP Certification Report Ongoing Certification Ongoing Certification Report (OCR)Provider Quarterly Review Regularly

Operationalize this rule

Boundera turns FedRAMP 20x requirements like CCM-QTR-SAR into assigned evidence, remediation work, and validation workflows.

See it on your cloud

Change history

2026-06-24Official launch of the FedRAMP Consolidated Rules for 2026.

Content provenance

Official requirement text is sourced from FedRAMP/rules . Boundera implementation guidance has not been fully reviewed for this item.