Skip to main content
WhyHow It WorksFeaturesPricingBlog
Sign inRequest demo

FedRAMP 20x for cloud service providers

Know what is required. Build it. Prove it.

Search every KSI and the 148 rules addressed to providers. See the requirement, implementation guidance, and evidence context without sorting through obligations owned by agencies, assessors, or FedRAMP.

Understand the 46 KSIsBrowse CSP rulesFind implementation guidanceFind automated checks

Based on FedRAMP/rules 2026.06.04.01-preview, updated 2026-06-04

CSP implementation explorer

Showing 254 of 254 CSP resources

Provider ruleCCMMUST
CCM-OCR-AFS

Anonymized Feedback Summary

All service classesOfficial source
Provider ruleCCMMUST
CCM-OCR-AVL

Report Availability

All service classesOfficial source
Provider ruleCCMMUST
CCM-OCR-FBM

Feedback Mechanism

All service classesOfficial source
Provider ruleCCMMUST NOT
CCM-OCR-LSI

Limit Sensitive Information

All service classesOfficial source
Provider ruleCCMMUST
CCM-OCR-NRD

Next Report Date

All service classesOfficial source
Provider ruleCCMMAY
CCM-OCR-RPS

Responsible Public Certification Report Sharing

All service classesOfficial source
Provider ruleCCMSHOULD
CCM-OCR-SOR

Spread Out Reports

All service classesOfficial source
Provider ruleCCMSHOULD
CCM-QTR-ACT

Additional Content

All service classesOfficial source
Provider ruleCCM
CCM-QTR-MTG

Quarterly Review Meeting

Classes A, B, C, DOfficial source
Provider ruleCCMMUST NOT
CCM-QTR-NID

No Irresponsible Disclosure

All service classesOfficial source
Provider ruleCCMMUST
CCM-QTR-NRD

Next Review Date

All service classesOfficial source
Provider ruleCCMMUST
CCM-QTR-REG

Meeting Registration Info

All service classesOfficial source
Provider ruleCCMSHOULD NOT
CCM-QTR-RTP

Restrict Third Parties

All service classesOfficial source
Provider ruleCCMSHOULD
CCM-QTR-RTR

Record/Transcribe Reviews

All service classesOfficial source
Provider ruleCCMSHOULD
CCM-QTR-SAR

Schedule Around Reports

All service classesOfficial source
Provider ruleCCMMAY
CCM-QTR-SCR

Share Content Responsibly

All service classesOfficial source
Provider ruleCCMMAY
CCM-QTR-SRR

Share Recordings Responsibly

All service classesOfficial source
Provider ruleCDS
CDS-CSO-AVR

Availability Reporting

Classes A, B, C, DOfficial source
Provider ruleCDSMUST
CDS-CSO-CBF

Consistency Between Formats

All service classesOfficial source
Provider ruleCDSMUST
CDS-CSO-HAD

Historical FedRAMP Certification Data

All service classesOfficial source
Provider ruleCDS
CDS-CSO-PSM

Per-Service Certification Materials

Classes A, B, C, DOfficial source
Provider ruleCDSMUST
CDS-CSO-PUB

Public Information

All service classesOfficial source
Provider ruleCDSMUST
CDS-CSO-RIS

Responsible Information Sharing

All service classesOfficial source
Provider ruleCDSMAY
CDS-CSO-RPS

Responsible Public Package Sharing

All service classesOfficial source
Provider ruleCDSMUST
CDS-CSO-SVC

Service List

All service classesOfficial source
Provider ruleCDSMUST
CDS-CSO-UTC

Use Trust Centers

All service classesOfficial source
Provider ruleCDSMUST
CDS-TRC-AAI

Agency Access Inventory

All service classesOfficial source
Provider ruleCDSMUST
CDS-TRC-ACL

Access Logging

All service classesOfficial source
Provider ruleCDSSHOULD
CDS-TRC-HMR

Human and Machine-Readable Certification Data

All service classesOfficial source
Provider ruleCDSMUST
CDS-TRC-PAC

Programmatic Access

All service classesOfficial source
Provider ruleCDSSHOULD
CDS-TRC-SSM

Self-Service Access Management

All service classesOfficial source
Provider ruleCDSMUST
CDS-TRC-USH

Uninterrupted Sharing

All service classesOfficial source
Provider ruleCDSMUST
CDS-UTC-AAD

Agency Access Denial

All service classesOfficial source
Provider ruleCDSSHOULD
CDS-UTC-AGA

Agency Access

All service classesOfficial source
Provider ruleFRAMAY
FRA-CSO-RAA

Receiving Assessor Advice

All service classesOfficial source
Provider ruleFRASHOULD
FRA-CSO-STE

Supply Technical Evidence

All service classesOfficial source
Definition
FRD-AAP

All Affected Parties

All service classesOfficial source
Definition
FRD-ACV

Accepted Vulnerability

All service classesOfficial source
Definition
FRD-ADP

Adaptive Change

All service classesOfficial source
Definition
FRD-AGY

Agency

All service classesOfficial source
Definition
FRD-ANP

All Necessary Parties

All service classesOfficial source
Definition
FRD-ART

Artifacts

All service classesOfficial source
Definition
FRD-ASR

Assessor

All service classesOfficial source
Definition
FRD-CCC

Certification Class Change

All service classesOfficial source
Definition
FRD-CRD

Certification Data

All service classesOfficial source
Definition
FRD-CRP

Certification Package

All service classesOfficial source
Definition
FRD-CSO

Cloud Service Offering

All service classesOfficial source
Definition
FRD-DCE

Debilitating Customer Effect

All service classesOfficial source
Definition
FRD-DCF

Disruptive Customer Effect

All service classesOfficial source
Definition
FRD-DFT

Drift

All service classesOfficial source
Definition
FRD-FCD

Federal Customer Data

All service classesOfficial source
Definition
FRD-FCT

FedRAMP Certified

All service classesOfficial source
Definition
FRD-FIR

Final Incident Report (FIR)

All service classesOfficial source
Definition
FRD-FMV

Fully Mitigated Vulnerability

All service classesOfficial source
Definition
FRD-FPV

False Positive Vulnerability

All service classesOfficial source
Definition
FRD-FRA

FedRAMP Recognized

All service classesOfficial source
Definition
FRD-FRI

FedRAMP Reportable Incident

All service classesOfficial source
Definition
FRD-FSI

FedRAMP Security Inbox

All service classesOfficial source
Definition
FRD-HAN

Handle

All service classesOfficial source
Definition
FRD-IIR

Initial Incident Report (IIR)

All service classesOfficial source
Definition
FRD-INC

Initial Certification

All service classesOfficial source
Definition
FRD-INT

Incident

All service classesOfficial source
Definition
FRD-IRS

Information Resource

All service classesOfficial source
Definition
FRD-IRV

Internet-Reachable Vulnerability (IRV)

All service classesOfficial source
Definition
FRD-KEV

Known Exploited Vulnerability (KEV)

All service classesOfficial source
Definition
FRD-LEV

Likely Exploitable Vulnerability (LEV)

All service classesOfficial source
Definition
FRD-LKY

Likely

All service classesOfficial source
Definition
FRD-MBI

Machine-Based (Information Resources)

All service classesOfficial source
Definition
FRD-MCE

Minimal Customer Effect

All service classesOfficial source
Definition
FRD-MRD

Machine-Readable

All service classesOfficial source
Definition
FRD-NCE

Narrow Customer Effect

All service classesOfficial source
Definition
FRD-OCR

Ongoing Certification Report (OCR)

All service classesOfficial source
Definition
FRD-ODV

Overdue Vulnerability

All service classesOfficial source
Definition
FRD-ONC

Ongoing Certification

All service classesOfficial source
Definition
FRD-PAC

Privileged Account

All service classesOfficial source
Definition
FRD-PAI

Potential Agency Impact

All service classesOfficial source
Definition
FRD-PER

Persistently

All service classesOfficial source
Definition
FRD-PMV

Partially Mitigated Vulnerability

All service classesOfficial source
Definition
FRD-PRO

Promptly

All service classesOfficial source
Definition
FRD-PRV

Provider

All service classesOfficial source
Definition
FRD-QTR

Quarterly Review

All service classesOfficial source
Definition
FRD-RGL

Regularly

All service classesOfficial source
Definition
FRD-RMV

Remediated Vulnerability

All service classesOfficial source
Definition
FRD-RSP

Responsibly

All service classesOfficial source
Definition
FRD-RTR

Routine Recurring Change

All service classesOfficial source
Definition
FRD-SCT

Security Category

All service classesOfficial source
Definition
FRD-SGC

Significant Change

All service classesOfficial source
Definition
FRD-TLA

Top-Level Administrative Account

All service classesOfficial source
Definition
FRD-TPR

Third-Party Information Resource

All service classesOfficial source
Definition
FRD-TRC

Trust Center

All service classesOfficial source
Definition
FRD-TRF

Transformative Change

All service classesOfficial source
Definition
FRD-VLD

Vulnerability Detection

All service classesOfficial source
Definition
FRD-VLN

Validation

All service classesOfficial source
Definition
FRD-VLR

Vulnerability Response

All service classesOfficial source
Definition
FRD-VRF

Verification

All service classesOfficial source
Definition
FRD-VUL

Vulnerability

All service classesOfficial source
Provider ruleFSISHOULD
FSI-CSO-ACK

Acknowledge Receipt

All service classesOfficial source
Provider ruleFSIMUST
FSI-CSO-CRA

Complete Required Actions

All service classesOfficial source
Provider ruleFSIMUST
FSI-CSO-EMR

Emergency Message Routing

All service classesOfficial source
Provider ruleFSISHOULD
FSI-CSO-IMA

Important Message Actions

All service classesOfficial source
Provider ruleFSIMUST
FSI-CSO-INB

Maintain a FedRAMP Security Inbox

All service classesOfficial source
Provider ruleFSIMUST
FSI-CSO-NOC

Notification of Changes

All service classesOfficial source
Provider ruleFSIMUST
FSI-CSO-RCV

Receive Email Without Disruption

All service classesOfficial source
Provider ruleFSIMUST
FSI-CSO-TFG

Trust @fedramp.gov and @gsa.gov

All service classesOfficial source
Provider ruleICPSHOULD
ICP-CSO-AIR

Automated Incident Reporting

All service classesOfficial source
Provider ruleICPMUST
ICP-CSO-DPR

Default PAIN Rating

All service classesOfficial source
Provider ruleICPSHOULD
ICP-CSO-EFI

Estimate Federal Impact

All service classesOfficial source
Provider ruleICPMUST
ICP-CSO-EFR

Evaluate FedRAMP Reportability

All service classesOfficial source
Provider ruleICP
ICP-CSO-FIR

Final Incident Report

Classes A, B, C, DOfficial source
Provider ruleICP
ICP-CSO-IIR

Initial Incident Report

Classes A, B, C, DOfficial source
Provider ruleICP
ICP-CSO-OIR

Ongoing Incident Reports

Classes A, B, C, DOfficial source
Provider ruleIFRMUST
IFR-APP-AFC

Applying for FedRAMP Certification

All service classesOfficial source
Provider ruleIFRMUST
IFR-APP-FCP

Fresh FedRAMP Certification Package

All service classesOfficial source
Provider ruleIFRMUST
IFR-APP-FIA

Fresh Independent Assessment

All service classesOfficial source
Provider ruleIFRMUST
IFR-APP-MLF

Marketplace Listing First

All service classesOfficial source
Provider ruleIFRMUST
IFR-APS-ATO

Agency Authorization to Operate

All service classesOfficial source
Provider ruleIFRMUST
IFR-CLA-AFR

Address FedRAMP Rules

All service classesOfficial source
Provider ruleIFRMUST
IFR-CLA-ASF

Approved Alternative Security Frameworks

All service classesOfficial source
Provider ruleIFRMUST
IFR-CLA-EAM

External Assessment Materials

All service classesOfficial source
Provider ruleIFRMAY
IFR-CLA-IVV

Optional Independent Verification and Validation

All service classesOfficial source
Provider ruleIFRMUST
IFR-CLA-KSM

Key Security Indicator Mapping

All service classesOfficial source
Provider ruleIFR
IFR-CSO-PKG

FedRAMP Certification Package

Classes A, B, C, DOfficial source
Provider ruleIFRMUST NOT
IFR-CSO-POP

Pick One Program Certification Type

All service classesOfficial source
Provider ruleIFRSHOULD
IFR-CSX-MAS

Application within MAS

All service classesOfficial source
Provider ruleIFRMUST
IFR-CSX-SUM

Initial Implementation Summaries

All service classesOfficial source
KSICED
KSI-CED-RAT

Reviewing All Training

All service classesOfficial source
KSICMT
KSI-CMT-LMC

Logging Changes

All service classesOfficial source
KSICMT
KSI-CMT-RMV

Redeploying vs Modifying

All service classesOfficial source
KSICMT
KSI-CMT-RVP

Reviewing Change Procedures

All service classesOfficial source
KSICMT
KSI-CMT-VTD

Validating Throughout Deployment

All service classesOfficial source
KSICNA
KSI-CNA-DFP

Defining Functionality and Privileges

All service classesOfficial source
KSICNA
KSI-CNA-EIS

Enforcing Intended State

Classes B, COfficial source
KSICNA
KSI-CNA-IBP

Implementing Best Practices

All service classesOfficial source
KSICNA
KSI-CNA-MAT

Minimizing Attack Surface

All service classesOfficial source
KSICNA
KSI-CNA-OFA

Optimizing for Availability

All service classesOfficial source
KSICNA
KSI-CNA-RNT

Restricting Network Traffic

All service classesOfficial source
KSICNA
KSI-CNA-RVP

Reviewing Protections

All service classesOfficial source
KSICNA
KSI-CNA-ULN

Using Logical Networking

All service classesOfficial source
KSIIAM
KSI-IAM-AAM

Automating Account Management

All service classesOfficial source
KSIIAM
KSI-IAM-APM

Adopting Passwordless Methods

All service classesOfficial source
KSIIAM
KSI-IAM-ELP

Ensuring Least Privilege

All service classesOfficial source
KSIIAM
KSI-IAM-JIT

Authorizing Just-in-Time

All service classesOfficial source
KSIIAM
KSI-IAM-SNU

Securing Non-User Authentication

All service classesOfficial source
KSIIAM
KSI-IAM-SUS

Responding to Suspicious Activity

All service classesOfficial source
KSIINR
KSI-INR-AAR

Generating After Action Reports

All service classesOfficial source
KSIINR
KSI-INR-RIR

Reviewing Incident Response Procedures

All service classesOfficial source
KSIINR
KSI-INR-RPI

Reviewing Past Incidents

All service classesOfficial source
KSIMLA
KSI-MLA-ALA

Authorizing Log Access

Classes B, COfficial source
KSIMLA
KSI-MLA-EVC

Evaluating Configurations

All service classesImplementation guidance Automated check
KSIMLA
KSI-MLA-LET

Logging Event Types

All service classesOfficial source
KSIMLA
KSI-MLA-OSM

Operating SIEM Capability

All service classesOfficial source
KSIMLA
KSI-MLA-RVL

Reviewing Logs

All service classesOfficial source
KSIPIY
KSI-PIY-GIV

Generating Inventories

All service classesOfficial source
KSIPIY
KSI-PIY-RES

Reviewing Executive Support

All service classesOfficial source
KSIPIY
KSI-PIY-RIS

Reviewing Investments in Security

All service classesOfficial source
KSIPIY
KSI-PIY-RSD

Reviewing Security in the SDLC

All service classesOfficial source
KSIPIY
KSI-PIY-RVD

Reviewing Vulnerability Disclosures

All service classesOfficial source
KSIRPL
KSI-RPL-ABO

Aligning Backups with Objectives

All service classesOfficial source
KSIRPL
KSI-RPL-ARP

Aligning Recovery Plan

All service classesOfficial source
KSIRPL
KSI-RPL-RRO

Reviewing Recovery Objectives

All service classesOfficial source
KSIRPL
KSI-RPL-TRC

Testing Recovery Capabilities

All service classesOfficial source
KSISCR
KSI-SCR-MIT

Mitigating Supply Chain Risk

All service classesOfficial source
KSISCR
KSI-SCR-MON

Monitoring Supply Chain Risk

All service classesOfficial source
KSISVC
KSI-SVC-ACM

Automating Configuration Management

All service classesOfficial source
KSISVC
KSI-SVC-ASM

Automating Secret Management

All service classesOfficial source
KSISVC
KSI-SVC-EIS

Evaluating and Improving Security

All service classesOfficial source
KSISVC
KSI-SVC-PRR

Preventing Residual Risk

Classes B, COfficial source
KSISVC
KSI-SVC-RUD

Removing Unwanted Data

Classes B, COfficial source
KSISVC
KSI-SVC-SNT

Securing Network Traffic

All service classesOfficial source
KSISVC
KSI-SVC-VCM

Validating Communications

Classes B, COfficial source
KSISVC
KSI-SVC-VRI

Validating Resource Integrity

All service classesOfficial source
Provider ruleMASMUST
MAS-CSO-FLO

Information Flows and Security Categories

All service classesOfficial source
Provider ruleMASMUST
MAS-CSO-IIR

Identify Information Resources

All service classesOfficial source
Provider ruleMASMUST
MAS-CSO-MDI

Metadata Inclusion

All service classesOfficial source
Provider ruleMASMAY
MAS-CSO-SUP

Supplemental Information

All service classesOfficial source
Provider ruleMASMUST
MAS-CSO-TPR

Third-Party Information Resources

All service classesOfficial source
Provider ruleMKTMUST
MKT-CSO-AGU

Agency Use Cases

All service classesOfficial source
Provider ruleMKTMUST
MKT-CSO-LRQ

Listing Requests for Providers

All service classesOfficial source
Provider ruleMKTMUST
MKT-PRE-DCP

Demonstrating Continuous Progress

All service classesOfficial source
Provider ruleMKTMUST
MKT-PRE-DLA

Deadline for Assessment

All service classesOfficial source
Provider ruleMKTMUST
MKT-PRE-REQ

Preparation Phase Requirements

All service classesOfficial source
Provider ruleOFRMUST
OFR-AFR-CCM

Collaborative Continuous Monitoring

All service classesOfficial source
Provider ruleOFRMUST
OFR-AFR-CDS

FedRAMP Certification Data Sharing

All service classesOfficial source
Provider ruleOFRMUST
OFR-AFR-FSI

FedRAMP Security Inbox

All service classesOfficial source
Provider ruleOFRMUST
OFR-AFR-ICP

Incident Communications Procedures

All service classesOfficial source
Provider ruleOFRMUST
OFR-AFR-MAS

Minimum Assessment Scope

All service classesOfficial source
Provider ruleOFRMUST
OFR-AFR-SCG

Secure Configuration Guide

All service classesOfficial source
Provider ruleOFRMUST
OFR-AFR-SCN

Significant Change Notifications

All service classesOfficial source
Provider ruleOFRMUST
OFR-AFR-UCM

Using Cryptographic Modules

All service classesOfficial source
Provider ruleOFRMUST
OFR-AFR-VDR

Vulnerability Detection and Response

All service classesImplementation guidance
Provider ruleOFR
OFR-CSO-IVV

Independent Verification and Validation

Classes A, B, C, DOfficial source
Provider ruleSCGMUST
SCG-CSO-AUP

Use Instructions

All service classesOfficial source
Provider ruleSCGSHOULD
SCG-CSO-PUB

Public Secure Configuration Guidance

All service classesOfficial source
Provider ruleSCGMUST
SCG-CSO-RSC

Recommended Secure Configuration

All service classesOfficial source
Provider ruleSCGSHOULD
SCG-CSO-SDF

Secure Defaults

All service classesOfficial source
Provider ruleSCGSHOULD
SCG-ENH-API

API Capability

All service classesOfficial source
Provider ruleSCGSHOULD
SCG-ENH-CMP

Comparison Capability

All service classesOfficial source
Provider ruleSCGSHOULD
SCG-ENH-EXP

Export Capability

All service classesOfficial source
Provider ruleSCGSHOULD
SCG-ENH-MRG

Machine-Readable Guidance

All service classesOfficial source
Provider ruleSCGSHOULD
SCG-ENH-VRH

Versioning and Release History

All service classesOfficial source
Provider ruleSCNMUST
SCN-ADP-NTF

Notification Requirements

All service classesOfficial source
Provider ruleSCNMAY
SCN-CSO-ARI

Additional Relevant Information

All service classesOfficial source
Provider ruleSCNMAY
SCN-CSO-EMG

Emergency Changes

All service classesOfficial source
Provider ruleSCNMUST
SCN-CSO-EVA

Evaluate Changes

All service classesOfficial source
Provider ruleSCNMUST
SCN-CSO-HIS

Historical Notifications

All service classesOfficial source
Provider ruleSCNMUST
SCN-CSO-HRM

Human and Machine-Readable Notifications

All service classesOfficial source
Provider ruleSCNMUST
SCN-CSO-INF

Required Information

All service classesOfficial source
Provider ruleSCNMUST
SCN-CSO-MAR

Maintain Audit Records

All service classesOfficial source
Provider ruleSCNMAY
SCN-CSO-NOM

Notification Mechanisms

All service classesOfficial source
Provider ruleSCNSHOULD NOT
SCN-RTR-NNR

No Notification Requirements

All service classesOfficial source
Provider ruleSCNMUST
SCN-TRF-NAF

Notification After Finishing

All service classesOfficial source
Provider ruleSCNMUST
SCN-TRF-NAV

Notification After Verification

All service classesOfficial source
Provider ruleSCNMUST
SCN-TRF-NFP

Notification of Final Plans

All service classesOfficial source
Provider ruleSCNMUST
SCN-TRF-NIP

Notification of Initial Plans

All service classesOfficial source
Provider ruleSCNSHOULD
SCN-TRF-TPR

Third-Party Review

All service classesOfficial source
Provider ruleSCNMUST
SCN-TRF-UPD

Update Documentation

All service classesOfficial source
Provider ruleUCMSHOULD
UCM-CSO-CAT

Configuration of Agency Tenants

All service classesOfficial source
Provider ruleUCMMUST
UCM-CSO-CMD

Cryptographic Module Documentation

All service classesOfficial source
Provider ruleUCM
UCM-CSO-UVM

Using Validated Cryptographic Modules

Classes A, B, C, DOfficial source
Provider ruleVDRSHOULD
VDR-BST-ADT

Automate Detection

All service classesOfficial source
Provider ruleVDRSHOULD NOT
VDR-BST-AKE

Avoid KEVs

All service classesOfficial source
Provider ruleVDRSHOULD
VDR-BST-DAC

Detect After Changes

All service classesOfficial source
Provider ruleVDRSHOULD
VDR-BST-DFR

Design For Resilience

All service classesOfficial source
Provider ruleVDRSHOULD NOT
VDR-BST-MSP

Maintain Security

All service classesOfficial source
Provider ruleVDRMAY
VDR-BST-SIR

Sampling

All service classesOfficial source
Provider ruleVDRMUST
VDR-CSO-DET

Vulnerability Detection

All service classesOfficial source
Provider ruleVDRMUST
VDR-CSO-FAV

Failures Are Vulnerabilities

All service classesOfficial source
Provider ruleVDRMUST
VDR-CSO-RES

Vulnerability Response

All service classesOfficial source
Provider ruleVDRSHOULD
VDR-EVA-EFA

Evaluation Factors

All service classesOfficial source
Provider ruleVDRSHOULD
VDR-EVA-EFP

Evaluate False Positives

All service classesOfficial source
Provider ruleVDRMUST
VDR-EVA-EIR

Evaluate Internet-Reachability

All service classesOfficial source
Provider ruleVDRMUST
VDR-EVA-ELX

Evaluate Exploitability

All service classesOfficial source
Provider ruleVDRMUST
VDR-EVA-EPA

Estimate Potential Adverse Impact

All service classesOfficial source
Provider ruleVDRSHOULD
VDR-EVA-GRV

Group Vulnerabilities

All service classesOfficial source
Provider ruleVDRMUST
VDR-RPT-AVI

Accepted Vulnerability Info

All service classesOfficial source
Provider ruleVDRSHOULD
VDR-RPT-HLO

High-Level Overviews

All service classesOfficial source
Provider ruleVDRMUST NOT
VDR-RPT-NID

Responsible Disclosure

All service classesOfficial source
Provider ruleVDRMUST
VDR-RPT-PER

Persistent Reporting

All service classesOfficial source
Provider ruleVDRMAY
VDR-RPT-RPD

Responsible Public Disclosure

All service classesOfficial source
Provider ruleVDRMUST
VDR-RPT-VDT

Vulnerability Details

All service classesOfficial source
Provider ruleVDR
VDR-TFR-EVU

Evaluate Vulnerabilities Quickly

Classes A, B, C, DOfficial source
Provider ruleVDR
VDR-TFR-IRI

Internet-Reachable Incidents

Classes A, B, C, DOfficial source
Provider ruleVDRSHOULD
VDR-TFR-KEV

Remediate KEVs

All service classesOfficial source
Provider ruleVDRMUST
VDR-TFR-MAV

Mark Accepted Vulnerabilities

All service classesOfficial source
Provider ruleVDRMUST
VDR-TFR-MHR

Monthly Activity Report

All service classesOfficial source
Provider ruleVDR
VDR-TFR-MRH

Historical Activity

Classes A, B, C, DOfficial source
Provider ruleVDR
VDR-TFR-MVX

Persistent Machine Verification and Validation for 20x

Classes A, B, COfficial source
Provider ruleVDRMUST
VDR-TFR-NMV

Non-Machine Verification and Validation

All service classesOfficial source
Provider ruleVDR
VDR-TFR-NRI

Non-Internet-Reachable Incidents

Classes A, B, C, DOfficial source
Provider ruleVDR
VDR-TFR-PCD

Persistently Complete Detection

Classes A, B, C, DOfficial source
Provider ruleVDR
VDR-TFR-PDD

Persistent Drift Detection

Classes A, B, C, DOfficial source
Provider ruleVDR
VDR-TFR-PSD

Persistent Sample Detection

Classes A, B, C, DOfficial source
Provider ruleVDR
VDR-TFR-PVR

Mitigation and Remediation Expectations

Classes A, B, C, DOfficial source
Provider ruleVDRSHOULD
VDR-TFR-RMN

Remaining Vulnerabilities

All service classesOfficial source