Ensure implementation of all required non-technical controls, and manage day to day 3PAO, advisory, and accelerator vendor relationships as the program moves beyond Class A. Drive timely remediation of risks and control gaps surfaced through audits, vulnerability scans, and penetration tests; translate technical findings into business-risk context for internal executives and (where applicable) external parties; bring risk acceptance proposals to the ISSM; escalate high-risk blockers to the Head of Risk and Compliance and/or CISO. Operationalize the post-certification maintenance program: recurring KSI reviews, POA&M-style remediation tracking, and the required ongoing reporting cycle to FedRAMP (certification data changes, accepted vulnerabilities, transformative changes, agencies using the service, reportable incidents).