Q: Must Class A providers automate the SDR?
A: It is not a mandatory Class A requirement. Class A CSPs may use automated methods to persistently verify and validate the SDR when applicable. However, automation is valuable where it prevents differences between the actual environment, machine-readable data, human-readable descriptions, and evidence links.
Source: fedramp
