What is the role of the third party assessment organization (3PAO) in continuous monitoring?

For the FedRAMP Program Authorization process, cloud service providers (CSPs) must use a FedRAMP recognized 3PAO for annual assessments of its cloud offering and to evaluate the impact of those changes. For the FedRAMP Agency Authorization process, a FedRAMP recognized 3PAO is recommended, but is not required. Additionally, some CSPs may acquire 3PAO services for monthly continuous monitoring.