Q: What automation is recommended for Class A vulnerability monitoring?
A: For Class A, FedRAMP recommends validating machine-based information resources at least monthly. It also recommends persistent vulnerability detection at least every six months for resources unlikely to drift, every three months for resources likely to drift, and every 14 days for representative samples of similar machine-based resources.
Source: fedramp
