FedRAMP 20x: Evidence for Non-Automatable Exploitation

A vulnerability review can stall on a claim that exploitation “needs human interaction” or that no public exploit script exists. For Class B and C teams, the useful next step is to examine the evidence behind that claim. The FedRAMP 20x exploitation automation assumption supplies a clear default while that work proceeds.

Apply the assumption to exploitation

VER-EVA-AIA, “Assume It's Automatable,” states: “Providers MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise.” The object of this requirement is exploitation. This rule does not itself require automating the provider's evaluation process. Without evidence proving the exception, retain the default assumption. FedRAMP Vulnerability Evaluation and Reporting

Keep the assertion narrow enough to examine: identify the vulnerability, the affected resource and its actual operating context. “This is a complicated attack” leaves the reviewer with little to evaluate. A useful explanation identifies the claimed barrier to automation and the evidence that establishes it in the relevant context.

Keep the full exploitability decision intact

VER-EVA-ELX separately requires providers to evaluate detected vulnerabilities in the context of their cloud service offering to determine whether they are likely exploitable vulnerabilities. FedRAMP evaluation rules

FedRAMP's LEV definition joins three conditions: the vulnerability is not fully mitigated, it is reachable by a likely threat actor, and a likely threat actor who knows about it would likely gain unauthorized access, cause harm, disrupt operations or produce another undesired adverse impact within the offering by exploiting it. The definition also establishes a minimum: a vulnerability that an automated, unauthenticated system can exploit over the internet is a likely exploitable vulnerability. FedRAMP definition: Likely Exploitable Vulnerability

Read AIA together with ELX and that definition. The default assumption about automation does not, by itself, establish every condition for a LEV. Evidence that exploitation cannot be automated likewise does not, by itself, establish that the vulnerability is safe or not likely exploitable. Carry the automation finding into the contextual evaluation.

Make the evidence review reproducible

The following fields are an editorial working record, not an official evidentiary checklist or scoring model:

Use ordinary review questions to test the reasoning. A manual proof of concept shows how that demonstration was performed. Ask what establishes that the relevant steps cannot be automated. Similarly, if no public exploit script was found, ask what the search establishes about the vulnerability itself and what it leaves unknown. Treat both examples as reasoning prompts; neither should stand alone as proof of non-automatability.

For example, a review note might say: “The available demonstration uses manual interaction. Our evidence does not establish that automation is impossible in this operating context. Retain the AIA default; assign the remaining analysis to the resource owner.” This records uncertainty without converting it into an unsupported exception. If later evidence supports a different conclusion, retain its scope and limits with the decision.

Carry the conclusion into the remaining work

An AIA evidence finding answers one evaluation question. Reading the rules together, it does not waive the other applicable evaluation, response or reporting duties. Keep those activities connected to the vulnerability record. FedRAMP VER rules and VDR response rules

Use the evaluation queue guide to manage unfinished work, the internet reachability guide for the separate reachability question, and the PAIN rating guide for customer-impact evaluation.

Plan against the VER adoption schedule: optional adoption from July 4, 2026, obtaining and maintaining certification from December 7, 2026, and the grace-period end of March 7, 2027. AIA is an existing provision in the stable ruleset; its changelog records the June 24, 2026 launch. FedRAMP VER effective dates and rule history