Continuous monitoring
Staying compliant, continuously
An ATO is where continuous monitoring begins. BLC is built to make that monitoring a routine part of the work instead of a periodic scramble.
Monitoring on the FedRAMP 20x schedule
FedRAMP 20x continuous monitoring asks for key security indicator (KSI) metrics, vulnerability detection and vulnerability reporting, each on a defined schedule. BLC is built to run these from automated checkers and scans, with multiple automated validation methods behind each indicator, and to produce the reports on the FedRAMP 20x schedule.
Checker evidence, with freshness
A checker is a small program that answers one question, reports pass, fail, error or stale, and exits. A scheduler runs it. Every result carries the time it was produced.
If the evidence behind a check is too old to trust, the result is stale. That is neither a false pass nor a false fail, so out-of-date evidence is visible instead of hidden.
Remediation clocks on both rubrics
FedRAMP 20x ties remediation timeframes to its PAIN rating rather than to the CVSS score. BLC also tracks the legacy 800-53r5 timeframes. Each finding gets a clock for every rubric that applies, the earlier deadline drives the inbox, and each report reads the clock for its own track.
Findings start from cautious defaults: assumed reachable from the internet and likely to be exploited. Lowering either needs a risk-adjustment deviation that the security program manager signs.
A merge is evidence, not closure. A rescan clears a finding.
A merged pull request shows that a change was made. It does not close anything. Only a successful rescan clears an item that a scan raised. Findings that did not come from a scan are closed with evidence that fits how they were found.
Funded POA&Ms, not wishful ones
A plan with no budget is only text. BLC's cut-line planning lets the ISSO and the security program manager fit every required item against the money and time they have, and shows whether the work is on track, at risk, off track or over budget.
- Unfunded and zero-cost entries are surfaced, not hidden.
- Routine operations are marked as funded by normal operations, so the discretionary budget is honest.
- The ISSO drafts what-if versions. Only the security program manager accepts one.
- The accepted list becomes the POA&M list until another version is accepted, and the history shows which list was in force at any time.
Sharing the results
PlannedA FedRAMP-compatible trust center that serves the 20x data programmatically.