Cloud, hybrid and on-premises monitoring
Ongoing monitoring across on-premises systems, AWS, Azure and Google Cloud, or a hybrid of them.
Continuous monitoring for FedRAMP, FISMA and CMMC
Continuous Monitoring for FedRAMP, FISMA and CMMC Environments
Continuous monitoring is ongoing awareness of information security, vulnerabilities and threats, used to make risk decisions. Quzara delivers it in two parts that work together: Cybertorch, our 24/7 U.S. citizen SOC and managed XDR, and NISTcompliance.ai, our continuous assurance platform. NISTcompliance.ai operates inside the Cybertorch FedRAMP boundary on Azure Government.
24/7/365U.S. citizen SOC monitoring
Class D (High)FedRAMP Certified, Azure Government
DoD IL-4authorized impact level
One recordevidence, controls and decisions
Cybertorch Marketplace ID FR2214150164. FedRAMP Certified Class D (High) on Azure Government.
Start here
Where do you need continuous monitoring?
Cloud service providers
I run a cloud service that seeks or keeps FedRAMP Certification
Monitoring and evidence for Ongoing Certification Reports, Quarterly Reviews, vulnerability reporting and Key Security Indicators, backed by a Class D (High) SOC.
See the FedRAMP path Federal agenciesI own systems that must be authorized and monitored under FISMA
The full Risk Management Framework, assessments, POA&Ms and ongoing authorization on one record that the authorizing official can trust.
See the FISMA path Defense contractorsI handle CUI and need CMMC Level 2 monitoring without building a SOC
24/7 monitoring by U.S. citizen analysts and security controls you can inherit instead of build.
See the Cybertorch path
Overview
What continuous monitoring is, and why it is now a requirement
NIST defines information security continuous monitoring (ISCM) as maintaining ongoing awareness of information security, vulnerabilities and threats to support organizational risk management decisions. In practice it replaces the point-in-time audit with a standing program: controls are tested on a schedule, evidence stays current, and changes in risk reach the people who decide.
Federal policy now expects exactly that, and expects it in a form software can read. FISMA makes agency heads accountable for their information security programs. OMB Circular A-130 addresses continuous monitoring and ongoing authorization. The FedRAMP Authorization Act established a presumption of adequacy for reusing FedRAMP packages, and OMB M-24-15 holds that presumption in place as long as the authorization is actively maintained. The FedRAMP Consolidated Rules for 2026 (CR26) now set the cadences and formats for the data providers publish.
2014FISMAAgency heads are accountable for information security programs and periodic testing.
2016OMB A-130Addresses continuous monitoring and ongoing authorization of federal systems.
Dec 2022FedRAMP Authorization ActPresumption of adequacy for FedRAMP packages (44 U.S.C. 3613(e)).
Jul 2024OMB M-24-15Reuse, automation, and a continuous monitoring framework.
Jun 2026FedRAMP CR26Providers publish structured assurance data on set cadences.
Dec 7, 2026VDR and VERMandatory for every cloud service offering obtaining or maintaining FedRAMP Certification.
CR26 sets the formats and cadences for provider data. What each organization does with that data, every quarter and across every system, is its continuous monitoring program. Quzara runs both halves of that program: the monitoring and the assurance.
Primary sources NIST ISCM definition, FedRAMP collaborative continuous monitoring rules, FedRAMP Notice NTC-0014, 44 U.S.C. 3613, OMB M-24-15.
How it fits together
Two engines, one boundary
Monitoring generates signals. Assurance turns signals into decisions. Quzara runs both inside the same FedRAMP Certified Class D (High) boundary, so the evidence behind a decision is as current as the last event.
Your environment
Signals
Cloud, identity, endpoint, SaaS, OT and scanner telemetry, plus existing GRC data.
One FedRAMP Certified Class D (High) boundary · Azure Government · FR2214150164
Cybertorch
Detect and respond
24/7 SOC, managed XDR, SOAR and vulnerability management. Detections, incidents and response records become evidence.
NISTcompliance.ai
Assure and decide
Control testing, evidence with provenance, POA&Ms, assessments and authorization packages.
Your decision makers
Decisions
ISSOs, assessors and authorizing officials approve. Exports in OSCAL and DOCX.
Events update controls
A detection or a misconfiguration updates the controls it affects, so the authorizing official sees current posture instead of last quarter's.
No new boundary
Quzara's telemetry, evidence and authorization records stay inside one certified boundary rather than moving between tools.
Works with what you already run
Your SIEM, CDM and cloud security tools can feed the same record. Cybertorch is optional.
Quzara Cybertorch
The 24/7 monitoring layer, and the controls you can inherit
Cybertorch is Quzara's FedRAMP Certified Class D (High) managed XDR and SOC as a Service on Azure Government, authorized for DoD IL-4 and staffed by U.S. citizen analysts. It watches your environment around the clock, and it gives your compliance program controls to inherit instead of build.
Vulnerability management as a service
Continuous scanning, analysis, prioritization and reporting across infrastructure and applications.
SOC as a service
A subscription 24/7 SOC for threat detection and response, staffed by U.S. citizen analysts.
OT threat monitoring
Unifies OT and IT signals into a single point of visibility for operational technology environments.
POA&M support
FedRAMP, CMMC and DoD vulnerability POA&M support in the framework your program uses.
Custom reporting and dashboards
Alerts and tailored dashboards give continuous visibility into infrastructure, applications and network.
Microsoft security and compliance
SOAR built on Microsoft Sentinel and Defender XDR, deployed into customer environments for incident response.
Inheritable security controls
Predefined controls that drop into your existing security infrastructure for immediate use.
Inherit controls instead of building them
Under FedRAMP, FISMA and CMMC, a provider's documented controls can satisfy requirements in your own system security plan. You inherit the part Cybertorch operates and keep the part you own.
| Control area | What Cybertorch operates | What you keep |
|---|---|---|
| Audit and accountability (AU) | Centralized log collection, correlation and alerting across your monitored sources, run by the SOC. | Choosing which systems send logs, and audit policy inside your own applications. |
| Incident response (IR) | 24/7 detection, triage and response actions through SOAR playbooks, with incident records. | Your incident response plan, internal roles, and notification decisions. |
| Security assessment and monitoring (CA-7, SI-4) | System monitoring and the ongoing monitoring operations that feed your continuous monitoring strategy. | Your strategy, metrics and frequencies, and your authorizing official's decisions. |
| Vulnerability monitoring (RA-5) | Scheduled scanning, prioritization and reporting through vulnerability management as a service. | Remediating findings in your own systems, and accepting risk. |
Control inheritance is defined in Cybertorch's FedRAMP documentation and confirmed by your assessor for your system. The table is a summary at the control family level, not a substitute for the responsibility matrix.
For defense contractors, NIST SP 800-171 requirement 3.12.3 calls for monitoring security controls on an ongoing basis. Cybertorch provides that monitoring for CMMC Level 2 environments through a SOC you do not have to staff.
NISTcompliance.ai
Continuous assurance for FedRAMP, FISMA and CMMC programs
NISTcompliance.ai is Quzara's AI-native continuous assurance platform. It operates inside the Cybertorch FedRAMP boundary on Azure Government and turns monitoring evidence into control determinations, POA&Ms and authorization packages. AI drafts, collects and compares. People decide.
FedRAMP providers
Key Security Indicator monitoring, vulnerability reporting evidence, and OSCAL package output for 20x and Rev5 programs.
Federal agencies under FISMA
The full RMF lifecycle: intake, control narratives, assessments, AI-assisted POA&Ms and ongoing authorization reporting.
Agencies using cloud services
Intake and review of provider Ongoing Certification Reports against each authorization to operate, keyed by FedRAMP ID.
How evidence becomes a decision
The same five steps serve a FedRAMP provider, a federal agency and an assessor.
Connect
Cloud and security telemetry, scanners, provider trust centers and existing GRC data.
Prove
An evidence ledger. Each claim carries its source, time and freshness.
Draft
AI drafts control narratives, POA&Ms and gap analysis, citing sources.
Decide
ISSOs, assessors and authorizing officials review, edit and approve.
Deliver
SSP, POA&M, OSCAL and DOCX exports, and briefings for the authorizing official.
Controls without current evidence are reported as unobserved, not as passing.
Eight modules, one evidence graph
Author
01
System Intake
FIPS 199, business impact analysis, boundary and inventory as structured data.
02
Documentation Co-Pilot
Drafts SSPs, policies, procedures and risk narratives.
Implement
03
Controls Catalog
Common controls, provider inheritance and framework crosswalks.
04
Co-Pilot Controls
Control narratives with responsible-party logic and resolved parameters.
Assess
05
Auditor Co-Pilot
Assessors query the package and evidence. Answers cite sources.
06
Workflows
Finding intake, triage, routing, approvals and ATO chain of custody.
Assure
07
Remediation and POA&M
Finding to fix to new evidence. The POA&M is a living record.
08
Continuous Assurance
Telemetry-backed control health and drift detection between assessments.
Design choices that matter to an authorizing official
Machine-readable output
OSCAL and DOCX exports. Agency templates and custom deliverables are configured, not rebuilt, when they map to JSON and OSCAL.
Evidence with provenance
Every claim carries its source, time and freshness. Unobserved controls are reported as unobserved.
Humans decide
AI drafts, compares and flags. ISSOs, assessors and authorizing officials make every determination.
Isolated by tenant
Per-customer data segregation, SSO with role-based access, and encryption in transit and at rest.
Inside the Cybertorch boundary
NISTcompliance.ai operates inside the Cybertorch FedRAMP boundary on Azure Government.
Multi-framework
NIST SP 800-53 Rev. 5, the RMF, FedRAMP, FISMA and CMMC Level 2 from one core engine.
FISMA continuous monitoring
Continuous assurance for the systems your agency owns
FISMA makes agency heads accountable for their information security programs, and OMB A-130 addresses continuous monitoring and ongoing authorization of federal systems. NISTcompliance.ai keeps the authorizing official's view current between assessments, not only at the next audit.
One platform across the RMF lifecycle
NISTcompliance.ai supports each step of the NIST Risk Management Framework (SP 800-37 Rev. 2) for the agency's own systems.
| RMF step | What NISTcompliance.ai does |
|---|---|
| Prepare and Categorize | Structured intake of boundary, inventory, data types and interconnections. |
| Select and Implement | A common control and inheritance catalog, with AI-drafted narratives and resolved parameters. |
| Assess | Pre-staged evidence packs, and conversational Q&A over the package for assessors. |
| Authorize | Package export in OSCAL and DOCX, with AI-assisted POA&Ms linked to remediation guidance. |
| Monitor | Continuous evidence collection, freshness tracking and ongoing authorization reporting. |
Authorization that stays current between assessments
Between assessments, the question is whether the system still looks the way the authorizing official approved it.
Collect
Evidence collectors pull configuration, identity and vulnerability data from cloud accounts and security tools.
Test
Each control is tested against the agency's own resolved parameter values.
Detect drift
Changes between assessments surface as drift, not as surprises at the next audit.
Decide
Results route to the ISSO and the authorizing official, who decide what action the drift requires.
The full assessment, inside the platform
Independent assessors and agency security control assessors test against linked evidence instead of screenshots on shared drives, and each finding keeps its evidence trail.
Scope
Time-boxed, read-only access scoped to the engagement.
Interrogate
Auditor Co-Pilot answers questions over the package, citing evidence and showing freshness.
Test
Evidence is pre-staged and linked to each control.
Find
Findings are raised, triaged and routed to control owners.
Report
Results and chain of custody stay with the authorization record.
Remediation as a closed loop
From finding to proof of fix in one record, aligned to POA&M practice under NIST SP 800-53 Rev. 5 control CA-5.
Intake
Findings from assessments, scans and telemetry land in one queue and become POA&M items.
Remediation Co-Pilot
Suggests fixes tied to pre-approved remediation guidance, with impact analysis.
AI-assisted POA&M
Drafts milestones, owners and due dates. The ISSO reviews and approves.
Re-evidence and close
New evidence verifies the fix before the item closes.
Collectors that run inside your boundary
Agency data stays under agency control. Choose the deployment mode that fits each system.
Mode 1
API connectors
Read-only roles into cloud, identity and SaaS APIs
Fastest start, with nothing to install
Suited to systems with approved outbound access
Mode 2
In-boundary collectors
Docker containers, Kubernetes workloads or Terraform modules in agency accounts
Evaluate in place, inside the authorization boundary
Work where direct internet egress is denied
Least privilege
Read-only roles defined in Terraform that the agency reviews before deployment.
Infrastructure as code
Versioned, reviewable and repeatable across systems and accounts.
Agency-controlled egress
Runs behind TIC and proxies. The agency decides what leaves.
Provenance
Each result records its source, collector version and time.
FedRAMP continuous monitoring
Providers publish. Agencies review.
FedRAMP's collaborative continuous monitoring puts obligations on both sides of a cloud authorization. Providers publish assurance data on a fixed cadence. Agencies that use the service review it. Quzara supports both sides.
For cloud service providers
The rules put a repeatable cadence on what providers publish. Quzara supplies the monitoring and the evidence behind it.
Ongoing Certification Reports
Providers publish an Ongoing Certification Report every 3 months, summarizing changes, planned changes, accepted vulnerabilities and reportable incidents. Cybertorch monitoring and NISTcompliance.ai evidence supply the underlying data.
Quarterly Reviews
Providers host a synchronous Quarterly Review every 3 months. It is required for Class C and D and recommended for Class B, and the rules recommend scheduling it 3 to 10 business days after the report is released.
Vulnerability rules
The Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules govern how providers find, evaluate and report vulnerabilities. See the VDR and VER guide.
Significant change notifications
Changes that affect the certified service are communicated to agencies under defined rules, so reviewers are not surprised by what changed.
Key Security Indicators
FedRAMP 20x measures security through Key Security Indicators backed by evidence that can be validated by machine. NISTcompliance.ai maps monitoring evidence to each indicator. See the KSI guide.
Machine-readable packages
OMB M-24-15 directs FedRAMP to automate authorization data with OSCAL. NISTcompliance.ai generates OSCAL packages. See OSCAL for FedRAMP.
Date that matters
December 7, 2026: VDR and VER become mandatory
FedRAMP Notice NTC-0014 makes the Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules mandatory on December 7, 2026 for every cloud service offering obtaining or maintaining FedRAMP Certification. FedRAMP allows offerings to maintain certification under a corrective action plan through March 7, 2027. After that date, certification is revoked for offerings not following the rules.
For agencies that use cloud services
Reusing a cloud authorization depends on ongoing monitoring.
The law presumes a FedRAMP package adequate for other agencies to reuse (44 U.S.C. 3613(e)). OMB M-24-15 holds that presumption in place as long as a FedRAMP authorization is actively maintained. Reuse therefore depends on monitoring that does not lapse.
For Class B, C and D services, CR26 puts a MUST on the agency side: review each Ongoing Certification Report to understand how changes may affect the risk tolerance agreed in the authorization to operate. Without a shared tool, each agency builds its own way to meet that obligation, and ten agencies repeat the same review ten times.
Ongoing Certification Report review across a portfolio
Intake
Reports and JSON are pulled from provider trust centers, keyed by FedRAMP ID.
Compare
Diff against last quarter: changes, accepted vulnerabilities and incidents.
Assess
Findings are weighed against each authorization's risk tolerance and security category.
Route
Queued to the designated senior official ahead of the Quarterly Review.
Record
A signed determination, authorization evidence and drafted provider notices.
One program for the controls you own and the controls you inherit
Agency-owned controls
FISMA continuous monitoring
NIST SP 800-137 ISCM and the RMF Monitor step
Continuous evidence from cloud, identity and security telemetry
Control assessments at the frequencies your ISCM strategy defines
Agency POA&Ms with remediation tracking and reporting to the authorizing official
Inherited cloud services
FedRAMP collaborative continuous monitoring
CR26 collaborative continuous monitoring, vulnerability and change rules
Ongoing Certification Reports every 3 months
Provider vulnerability data feeding agency POA&Ms where agency policy calls for it
Significant change notifications reviewed as they arrive
One monitoring program for owned and inherited controls.
NISTcompliance.ai merges both into one risk view per system, one review queue and one record for the authorizing official.
Side by side
FISMA and FedRAMP continuous monitoring compared
Most organizations answer to both. Seeing the two programs next to each other shows why one record is easier to run than two.
| Topic | FISMA continuous monitoring | FedRAMP continuous monitoring |
|---|---|---|
| Who is accountable | The agency head and the agency's authorizing officials. | The cloud service provider publishes. Agencies that use the service review what is published. |
| Scope | Agency systems, and systems that contractors operate on the agency's behalf. | Cloud service offerings that hold or seek FedRAMP Certification. |
| Governing sources | FISMA, OMB A-130, NIST SP 800-37 and NIST SP 800-137. | FedRAMP Consolidated Rules for 2026, OMB M-24-15 and 44 U.S.C. 3613. |
| Cadence | Set by the agency's ISCM strategy. | Ongoing Certification Reports every 3 months, with vulnerability and change rules of their own. |
| Output | Ongoing authorization decisions, POA&Ms and reporting to the authorizing official. | Ongoing Certification Reports, Quarterly Reviews, vulnerability reports and machine-readable data. |
| Where Quzara fits | Cybertorch for monitoring and NISTcompliance.ai for assurance, on one record. | Cybertorch as a certified boundary to build on, and NISTcompliance.ai for evidence, KSIs and OSCAL. |
Why Quzara
One firm that operates the platform and builds the automation
Quzara operates a FedRAMP Certified Class D (High) platform every day, and builds the AI that automates the compliance work beneath it. That is why the monitoring and the assurance fit together.
U.S. citizen only, 24/7 SOC
Analysts are U.S. citizens, and monitoring runs around the clock on Azure Government.
Controls you can inherit
Cybertorch provides FedRAMP, CMMC Level 2 and DoD IL-4 controls that customers inherit instead of build.
AI-native, human-led
NISTcompliance.ai drafts, collects and compares. ISSOs, assessors and authorizing officials decide.
Microsoft-native engineering
Microsoft Sentinel and Defender XDR implementation and optimization, from a Microsoft Intelligent Security Association member.
Machine-readable by design
OSCAL and DOCX output, so packages and reports move between tools without rework.
One portfolio, one record
Monitoring evidence feeds assurance, and assurance shows what to monitor next.
FedRAMP Certified Class D (High)DoD IL-4Marketplace ID FR2214150164GovRAMP validatedSOC 2 Type 2 audited (NISTcompliance.ai)GSA MAS with HACSSBA 8(a) CertifiedWomen-Owned Small BusinessMISA memberTenable Federal MSSPMSSP Alert Top 250
Trusted Partners
Cloud, security and contracting partners behind Quzara's monitoring and assurance programs.
Continuous monitoring questions
What is continuous monitoring?
NIST defines information security continuous monitoring as maintaining ongoing awareness of information security, vulnerabilities and threats to support organizational risk management decisions. In practice it is a standing program of control testing, evidence collection, vulnerability management and reporting that replaces the annual audit as the way an organization knows its risk.
How is FISMA continuous monitoring different from FedRAMP continuous monitoring?
FISMA continuous monitoring is the agency's program for the systems it owns or oversees. FedRAMP continuous monitoring is the collaborative program in which cloud providers publish assurance data and agencies review it for the services they use. Most agencies run both, and NISTcompliance.ai keeps them in one record.
What controls can I inherit from Cybertorch?
Cybertorch operates monitoring controls in areas such as audit and accountability, incident response, security assessment and continuous monitoring, and vulnerability scanning. Inheritance is defined in Cybertorch's FedRAMP documentation, and your assessor determines what applies to your system.
Do I need Cybertorch to use NISTcompliance.ai?
No. Your existing SIEM, CDM and cloud security tools can feed the same record. Cybertorch is optional, and the two work together when you use both.
Does NISTcompliance.ai replace my assessor or authorizing official?
No. AI drafts, collects and compares. ISSOs, assessors and authorizing officials make every determination, and controls without current evidence are reported as unobserved, not as passing.
What if my environment blocks outbound internet access?
Use in-boundary collectors. They run inside your accounts as Docker containers, Kubernetes workloads or Terraform modules, evaluate in place, and work where direct internet egress is denied. You decide what leaves.
What are VDR and VER, and when do they apply?
They are the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules. FedRAMP Notice NTC-0014 makes them mandatory on December 7, 2026 for every cloud service offering obtaining or maintaining FedRAMP Certification. See the VDR and VER guide.
Does this cover CMMC?
NIST SP 800-171 requirement 3.12.3 calls for monitoring security controls on an ongoing basis. Cybertorch provides 24/7 monitoring with inheritable controls for CMMC Level 2 environments, and NISTcompliance.ai maps evidence across NIST SP 800-171 and SP 800-53.
How is customer data protected?
NISTcompliance.ai operates inside the Cybertorch FedRAMP boundary on Azure Government, with per-customer data segregation, SSO with role-based access, and encryption in transit and at rest. Quzara operations are U.S. citizen only.
Bring continuous monitoring and continuous assurance into one program
Tell us which framework you answer to, FedRAMP, FISMA or CMMC, and we will walk through the monitoring you can inherit and the assurance you can automate. Engage Quzara through our GSA HACS vehicle or directly.