FedRAMP continuous monitoring (ConMon) evidence, re-checked on every scan
FedRAMP continuous monitoring (ConMon) asks a cloud service provider to show, every month, that the controls authorized at ATO still hold — an updated POA&M, a current inventory, monthly vulnerability scans, and an annual assessment. Onam covers the cloud-configuration part of that work: findings mapped to NIST 800-53 Rev 5, NIST 800-171 and the FedRAMP Moderate and High baselines, re-checked on every scan across the cloud accounts in your boundary, with evidence your team exports into the package.
One platform for government teams
Security evidence is covered in detail below. Inventory, cost and recovery work from the same discovery, so your cloud accounts are connected once.
Auditors start with what you run. Onam Estate keeps one inventory of every discovered resource across accounts and regions, and records every discovery run — so the asset list carries its own provenance instead of being an export from last quarter.
Posture, identity, data security and compliance evidence for government workloads. The detail is on the rest of this page.
Billed and effective cost side by side, cost attributed to owners and cost centres with the unattributed amount stated plainly, and forecasts as low, expected and high figures. Read-only: accepting a saving records a decision and changes nothing in your accounts.
Regulators expect tested recovery plans. Onam DRM maps applications and what they depend on, predicts RTO and RPO against the targets you set, records the drills you run with your own tools, and measures drift from the recovery model you approved. It plans and records; it does not run the failover.
Onam AIOps
Early accessAI agents that investigate your Onam Security data with evidence on every claim, and propose changes a person approves. Nothing changes your cloud without that approval.
What government teams solve with Onam Security
Monthly scanning — the cloud-configuration side
Every connected cloud account is re-scanned against posture rules mapped to 800-53 Rev 5 controls, and vulnerability findings carry EPSS and KEV context. Onam does not replace the authenticated operating-system, database and web-application scans your authorization specifies, or the raw scanner files an agency may ask for.
System inventory — the input, not the workbook
Onam discovers the resources in each connected account on every scan, so an asset that appeared since last month shows up with its findings. It does not fill in the FedRAMP Integrated Inventory Workbook; your team maps the discovered resources into it.
POA&M — the findings, not the document
Each failing control lists the resources that fail it, with severity and remediation guidance, exportable as PDF, CSV, Excel or JSON. Onam does not generate or maintain your POA&M; your team tracks the items and their deadlines there.
Deviation requests and accepted risk
Record an exception or compensating control with its justification, approver and target date. Exceptions are flagged as the date nears, so an accepted risk does not quietly become permanent. That record supports a deviation request; the request itself goes to your Authorizing Official.
Significant change — control status either side
After a change lands, the next scan re-checks the affected accounts against the same mapped controls, and the score and trend per framework show control status before and after. The significant change request and its security impact analysis stay with your team.
Annual assessment — evidence for your 3PAO
Onam is not a 3PAO and does not perform the annual assessment or penetration test. It gives the assessor per-control evidence — resources evaluated, results, timestamps — for automated cloud-configuration controls. Process controls such as training, personnel security and physical protection are marked for manual review, not scored.
Regulations & frameworks Onam Security maps to
The Rev 5 control catalog, with cloud-relevant families — AC, AU, CM, IA, SC, SI — mapped to cloud checks and evidence per control.
Moderate baseline mapped to cloud checks; process controls marked for manual review. PDF, CSV and Excel export.
High baseline mapped to cloud checks; process controls marked for manual review. PDF, CSV and Excel export.
800-171 requirements mapped to cloud checks for contractors handling CUI, with evidence per control to prepare for assessment.
Why government teams choose Onam
Built for continuous monitoring, not annual assessments
Control status re-checked on every scan, with a score and trend per framework and evidence exportable on demand.
From framework to the failing resource
Drill down from a framework to a control to the resources that fail it, with each finding's remediation guidance, so the people who own the fix see exactly what to change.
Findings per account
Compliance status is available per connected cloud account, so you can report on the accounts that make up a system's authorization boundary.
Hosted in the region you choose
Onam is hosted in a customer-chosen region — US, Europe, India or others — to meet your compliance requirements.
Evidence, in the Onam Security console.
An animated walkthrough of Onam console views with demo-account data — compliance scores, FAIR-style risk estimates and data classification.
Questions we get a lot
See Onam on your government cloud
Security evidence mapped to your frameworks, one inventory of what you run, cost you can attribute, and a recovery plan you can check — on one platform.