{"page":{"path":"/fedramp-20x/vulnerability-remediation-timelines","jsonPath":"/fedramp-20x/vulnerability-remediation-timelines.json","title":"FedRAMP VDR and VER Timelines by Class (2026 Rules)"},"release":{"version":"2026.10.13.01","lastUpdated":"2026-10-13","fileUrl":"https://github.com/FedRAMP/rules/blob/a89d78477ddea98dc57eca24f5007794c2b4eeb6/fedramp-consolidated-rules.json"},"lastChanged":"2026-10-13","processes":[{"process":"VDR","name":"Vulnerability Detection and Response","href":"/fedramp-20x/rules/vdr","sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/","effective":{"is":"required","current_status":"Mandated by CISA BOD 26-04","date":{"obtain":"2026-12-07","maintain":"2026-12-07","optional_adoption":"2026-07-04","grace":{"default":"2027-03-07","until_next_assessment":false}}},"applicability":{"types":["20x","Rev5"],"paths":["Program","Agency"],"classes":["B","C","D"]}},{"process":"VER","name":"Vulnerability Evaluation and Reporting","href":"/fedramp-20x/rules/ver","sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/","effective":{"is":"required","current_status":"Mandated by CISA BOD 26-04","date":{"obtain":"2026-12-07","maintain":"2026-12-07","optional_adoption":"2026-07-04","grace":{"default":"2027-03-07","until_next_assessment":false}}},"applicability":{"types":["20x","Rev5"],"paths":["Program","Agency"],"classes":["B","C","D"]}}],"effective":{"is":"required","current_status":"Mandated by CISA BOD 26-04","date":{"obtain":"2026-12-07","maintain":"2026-12-07","optional_adoption":"2026-07-04","grace":{"default":"2027-03-07","until_next_assessment":false}}},"effectiveMatches":true,"applicability":{"types":["20x","Rev5"],"paths":["Program","Agency"],"classes":["B","C","D"]},"classA":{"pullIns":[{"via":{"id":"FRC-CLA-MFR","href":"/fedramp-20x/rules/frc/cla-mfr","force":"MUST"},"rules":[{"id":"VDR-CSO-DET","name":"Vulnerability Detection","process":"VDR","subset":"CSO","scope":"all","href":"/fedramp-20x/rules/vdr/cso-det","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"}]},{"via":{"id":"FRC-CLA-RFR","href":"/fedramp-20x/rules/frc/cla-rfr","force":"SHOULD"},"rules":[{"id":"VDR-TFR-MVX","name":"Persistent Machine Verification and Validation for 20x","process":"VDR","subset":"TFR","scope":"20x","href":"/fedramp-20x/rules/vdr/tfr-mvx","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},{"id":"VDR-TFR-PCD","name":"Persistently Complete Detection","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-pcd","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},{"id":"VDR-TFR-PDD","name":"Persistent Drift Detection","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-pdd","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},{"id":"VDR-TFR-PSD","name":"Persistent Sample Detection","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-psd","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},{"id":"VDR-TFR-PVR","name":"Mitigation and Remediation Expectations","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-pvr","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},{"id":"VER-TFR-EVU","name":"Evaluate Vulnerabilities Quickly","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-evu","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"}]},{"via":{"id":"FRC-CLA-OFR","href":"/fedramp-20x/rules/frc/cla-ofr","force":"MAY"},"rules":[{"id":"VER-TFR-IRI","name":"Internet-Reachable Incidents","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-iri","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},{"id":"VER-TFR-MRH","name":"Historical Activity","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-mrh","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},{"id":"VER-TFR-NRI","name":"Non-Internet-Reachable Incidents","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-nri","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"}]}],"effective20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}}},"sequence":[{"step":1,"title":"Detect the vulnerability","rules":[{"ref":{"id":"VDR-CSO-DET","name":"Vulnerability Detection","process":"VDR","subset":"CSO","scope":"all","href":"/fedramp-20x/rules/vdr/cso-det","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"force":"MUST"}],"clock":"Persistently, at the detection cadences below"},{"step":2,"title":"Evaluate it within the window","rules":[{"ref":{"id":"VER-TFR-EVU","name":"Evaluate Vulnerabilities Quickly","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-evu","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"SHOULD"}],"clock":"A 14 days, B 7 days, C 5 days, D 2 days from detection"},{"step":3,"title":"Decide internet reachability, likely exploitability and the PAIN rating","rules":[{"ref":{"id":"VER-EVA-EIR","name":"Evaluate Internet-Reachability","process":"VER","subset":"EVA","scope":"all","href":"/fedramp-20x/rules/ver/eva-eir","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST"},{"ref":{"id":"VER-EVA-ELX","name":"Evaluate Exploitability","process":"VER","subset":"EVA","scope":"all","href":"/fedramp-20x/rules/ver/eva-elx","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST"},{"ref":{"id":"VER-EVA-EPA","name":"Estimate Potential Agency Impact","process":"VER","subset":"EVA","scope":"all","href":"/fedramp-20x/rules/ver/eva-epa","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST"},{"ref":{"id":"VER-EVA-AIA","name":"Assume It's Automatable","process":"VER","subset":"EVA","scope":"all","href":"/fedramp-20x/rules/ver/eva-aia","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST"}],"clock":"Part of the evaluation; assume exploitation can be automated"},{"step":4,"title":"Mitigate or remediate within the matrix","rules":[{"ref":{"id":"VDR-TFR-PVR","name":"Mitigation and Remediation Expectations","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-pvr","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"force":"SHOULD"}],"clock":"From evaluation, by PAIN rating, reachability and exploitability"},{"step":5,"title":"Treat it as a FedRAMP Reportable Incident above the thresholds","rules":[{"ref":{"id":"VER-TFR-IRI","name":"Internet-Reachable Incidents","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-iri","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"A MAY · B MAY · C SHOULD · D SHOULD"},{"ref":{"id":"VER-TFR-NRI","name":"Non-Internet-Reachable Incidents","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-nri","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"A MAY · B MAY · C MAY · D SHOULD"}],"clock":"While the rating stays above N3 (reachable) or at N5 (not reachable)"},{"step":6,"title":"Report it and keep the machine-readable history","rules":[{"ref":{"id":"VER-TFR-MHR","name":"Monthly Activity Report","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-mhr","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST"},{"ref":{"id":"VER-TFR-MRH","name":"Historical Activity","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-mrh","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"A MAY · B SHOULD · C SHOULD · D SHOULD"}],"clock":"Report at least every month; A 1 month, B 1 month, C 14 days, D 7 days for the JSON history"},{"step":7,"title":"Mark it accepted if it is still open","rules":[{"ref":{"id":"VER-TFR-MAV","name":"Mark Accepted Vulnerabilities","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-mav","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST"}],"clock":"192 days from evaluation"},{"step":8,"title":"Remediate Known Exploited Vulnerabilities by CISA's dates","rules":[{"ref":{"id":"VDR-TFR-KEV","name":"Remediate KEVs","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-kev","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"force":"SHOULD"}],"clock":"The due date in CISA's KEV catalog"}],"detection":{"rule":{"id":"VDR-CSO-DET","name":"Vulnerability Detection","process":"VDR","subset":"CSO","scope":"all","href":"/fedramp-20x/rules/vdr/cso-det","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"force":"MUST","timeframe":null,"statement":"Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices."},"evaluationRules":[{"rule":{"id":"VER-EVA-EIR","name":"Evaluate Internet-Reachability","process":"VER","subset":"EVA","scope":"all","href":"/fedramp-20x/rules/ver/eva-eir","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":null,"statement":"Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are internet-reachable vulnerabilities."},{"rule":{"id":"VER-EVA-ELX","name":"Evaluate Exploitability","process":"VER","subset":"EVA","scope":"all","href":"/fedramp-20x/rules/ver/eva-elx","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":null,"statement":"Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are likely exploitable vulnerabilities."},{"rule":{"id":"VER-EVA-EPA","name":"Estimate Potential Agency Impact","process":"VER","subset":"EVA","scope":"all","href":"/fedramp-20x/rules/ver/eva-epa","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":null,"statement":"Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to estimate the likely potential agency impact of exploitation on government customers AND assign one of the following Potential Agency Impact N-ratings (PAIN):"},{"rule":{"id":"VER-EVA-AIA","name":"Assume It's Automatable","process":"VER","subset":"EVA","scope":"all","href":"/fedramp-20x/rules/ver/eva-aia","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":null,"statement":"Providers MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise."}],"evaluation":{"rule":{"id":"VER-TFR-EVU","name":"Evaluate Vulnerabilities Quickly","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-evu","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"byClass":[{"serviceClass":"a","force":"SHOULD","timeframe":{"type":"days","num":14},"statement":"Providers with Class A Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 14 days of detection."},{"serviceClass":"b","force":"SHOULD","timeframe":{"type":"days","num":7},"statement":"Providers with Class B Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 7 days of detection."},{"serviceClass":"c","force":"SHOULD","timeframe":{"type":"days","num":5},"statement":"Providers with Class C Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 5 days of detection."},{"serviceClass":"d","force":"SHOULD","timeframe":{"type":"days","num":2},"statement":"Providers with Class D Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 2 days of detection."}]},"remediation":{"rule":{"id":"VDR-TFR-PVR","name":"Mitigation and Remediation Expectations","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-pvr","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"columns":[{"key":"irv_lev","label":"Internet-reachable and likely exploitable (IRV + LEV)","description":"Internet-Reachable Vulnerability + Likely Exploitable Vulnerability"},{"key":"nirv_lev","label":"Not internet-reachable, likely exploitable (NIRV + LEV)","description":"Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability"},{"key":"nlev","label":"Not likely exploitable (NLEV)","description":"Not Likely Exploitable Vulnerability"}],"ratings":["5","4","3","2","1"],"byClass":[{"serviceClass":"a","force":"SHOULD","timeframe":null,"statement":"Providers with Class A Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability.","matrix":{"1":{},"2":{"irv_lev":{"type":"days","num":96},"nirv_lev":{"type":"days","num":160},"nlev":{"type":"days","num":192}},"3":{"irv_lev":{"type":"days","num":32},"nirv_lev":{"type":"days","num":64},"nlev":{"type":"days","num":192}},"4":{"irv_lev":{"type":"days","num":8},"nirv_lev":{"type":"days","num":32},"nlev":{"type":"days","num":64}},"5":{"irv_lev":{"type":"days","num":4},"nirv_lev":{"type":"days","num":8},"nlev":{"type":"days","num":32}}}},{"serviceClass":"b","force":"SHOULD","timeframe":null,"statement":"Providers with Class B Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","matrix":{"1":{},"2":{"irv_lev":{"type":"days","num":96},"nirv_lev":{"type":"days","num":160},"nlev":{"type":"days","num":192}},"3":{"irv_lev":{"type":"days","num":32},"nirv_lev":{"type":"days","num":64},"nlev":{"type":"days","num":192}},"4":{"irv_lev":{"type":"days","num":8},"nirv_lev":{"type":"days","num":32},"nlev":{"type":"days","num":64}},"5":{"irv_lev":{"type":"days","num":4},"nirv_lev":{"type":"days","num":8},"nlev":{"type":"days","num":32}}}},{"serviceClass":"c","force":"SHOULD","timeframe":null,"statement":"Providers with Class C Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","matrix":{"1":{},"2":{"irv_lev":{"type":"days","num":48},"nirv_lev":{"type":"days","num":128},"nlev":{"type":"days","num":192}},"3":{"irv_lev":{"type":"days","num":16},"nirv_lev":{"type":"days","num":32},"nlev":{"type":"days","num":128}},"4":{"irv_lev":{"type":"days","num":4},"nirv_lev":{"type":"days","num":8},"nlev":{"type":"days","num":64}},"5":{"irv_lev":{"type":"days","num":2},"nirv_lev":{"type":"days","num":4},"nlev":{"type":"days","num":16}}}},{"serviceClass":"d","force":"SHOULD","timeframe":null,"statement":"Providers with Class D Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the maximum timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","matrix":{"1":{},"2":{"irv_lev":{"type":"days","num":24},"nirv_lev":{"type":"days","num":96},"nlev":{"type":"days","num":192}},"3":{"irv_lev":{"type":"days","num":8},"nirv_lev":{"type":"days","num":16},"nlev":{"type":"days","num":64}},"4":{"irv_lev":{"type":"days","num":2},"nirv_lev":{"type":"days","num":8},"nlev":{"type":"days","num":32}},"5":{"irv_lev":{"type":"hours","num":12},"nirv_lev":{"type":"days","num":1},"nlev":{"type":"days","num":8}}}}]},"cadences":{"classRules":[{"rule":{"id":"VDR-TFR-PCD","name":"Persistently Complete Detection","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-pcd","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"byClass":[{"serviceClass":"a","force":"SHOULD","timeframe":{"type":"months","num":6},"statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months."},{"serviceClass":"b","force":"SHOULD","timeframe":{"type":"months","num":6},"statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months."},{"serviceClass":"c","force":"SHOULD","timeframe":{"type":"months","num":1},"statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month."},{"serviceClass":"d","force":"SHOULD","timeframe":{"type":"months","num":1},"statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month."}]},{"rule":{"id":"VDR-TFR-PDD","name":"Persistent Drift Detection","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-pdd","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"byClass":[{"serviceClass":"a","force":"SHOULD","timeframe":{"type":"months","num":3},"statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 3 months."},{"serviceClass":"b","force":"SHOULD","timeframe":{"type":"months","num":1},"statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every month."},{"serviceClass":"c","force":"SHOULD","timeframe":{"type":"days","num":14},"statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days."},{"serviceClass":"d","force":"SHOULD","timeframe":{"type":"days","num":7},"statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 7 days."}]},{"rule":{"id":"VDR-TFR-PSD","name":"Persistent Sample Detection","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-psd","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"byClass":[{"serviceClass":"a","force":"SHOULD","timeframe":{"type":"days","num":14},"statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 14 days."},{"serviceClass":"b","force":"SHOULD","timeframe":{"type":"days","num":7},"statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 7 days."},{"serviceClass":"c","force":"SHOULD","timeframe":{"type":"days","num":3},"statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days."},{"serviceClass":"d","force":"SHOULD","timeframe":{"type":"days","num":1},"statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once per day."}]},{"rule":{"id":"VDR-TFR-MVX","name":"Persistent Machine Verification and Validation for 20x","process":"VDR","subset":"TFR","scope":"20x","href":"/fedramp-20x/rules/vdr/tfr-mvx","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"byClass":[{"serviceClass":"a","force":"SHOULD","timeframe":{"type":"months","num":1},"statement":"Providers of FedRAMP 20x Class A offerings SHOULD verify and validate the status of machine-based information resources at least once every month."},{"serviceClass":"b","force":"MUST","timeframe":{"type":"days","num":7},"statement":"Providers of FedRAMP 20x Class B offerings MUST verify and validate the status of machine-based information resources at least once every 7 days."},{"serviceClass":"c","force":"MUST","timeframe":{"type":"days","num":3},"statement":"Providers of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days."}]},{"rule":{"id":"VDR-TFR-MVF","name":"Persistent Machine Verification and Validation for Rev5","process":"VDR","subset":"TFR","scope":"rev5","href":"/consolidated-rules?rule=VDR-TFR-MVF","atlas":false,"sourceUrl":"https://github.com/FedRAMP/rules/blob/a89d78477ddea98dc57eca24f5007794c2b4eeb6/fedramp-consolidated-rules.json"},"byClass":[{"serviceClass":"b","force":"SHOULD","timeframe":{"type":"months","num":1},"statement":"Providers of FedRAMP Rev5 Class B offerings SHOULD verify and validate the status of machine-based information resources at least once every month."},{"serviceClass":"c","force":"MUST","timeframe":{"type":"months","num":1},"statement":"Providers of FedRAMP Rev5 Class C offerings MUST verify and validate the status of machine-based information resources at least once every month."},{"serviceClass":"d","force":"MUST","timeframe":{"type":"months","num":1},"statement":"Providers of FedRAMP Rev5 Class D offerings MUST verify and validate the status of machine-based information resources at least once every month."}]}],"fixedRules":[{"rule":{"id":"VDR-TFR-NMV","name":"Non-Machine Verification and Validation","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-nmv","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"force":"MUST","timeframe":{"type":"months","num":3},"statement":"Providers MUST verify and validate the status of non-machine-based information resources at least once every 3 months."}]},"reporting":{"monthly":{"rule":{"id":"VER-TFR-MHR","name":"Monthly Activity Report","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-mhr","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":{"type":"months","num":1},"statement":"Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly."},"history":{"rule":{"id":"VER-TFR-MRH","name":"Historical Activity","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-mrh","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"byClass":[{"serviceClass":"a","force":"MAY","timeframe":{"type":"months","num":1},"statement":"Providers with Class A Certifications MAY make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information MAY be updated persistently, at least once every month."},{"serviceClass":"b","force":"SHOULD","timeframe":{"type":"months","num":1},"statement":"Providers with Class B Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every month."},{"serviceClass":"c","force":"SHOULD","timeframe":{"type":"days","num":14},"statement":"Providers with Class C Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 14 days."},{"serviceClass":"d","force":"SHOULD","timeframe":{"type":"days","num":7},"statement":"Providers with Class D Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 7 days."}]},"fields":[{"rule":{"id":"VER-RPT-VDT","name":"Vulnerability Details","process":"VER","subset":"RPT","scope":"all","href":"/fedramp-20x/rules/ver/rpt-vdt","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":null,"statement":"Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability:","items":["Provider's internally assigned tracking identifier","Time and source of the detection","Time of completed evaluation","Is it an internet-reachable vulnerability or not?","Is it a likely exploitable vulnerability or not?","Historically and currently estimated Potential Agency Impact N-rating of exploitation","Time and Potential Agency Impact N-rating of each completed and evaluated reduction in Potential Agency Impact N-rating","Estimated time and target Potential Agency Impact N-rating of next reduction in Potential Agency Impact N-rating","Is it currently or is it likely to become an overdue vulnerability or not? If so, explain.","Any supplementary information the provider responsibly determines will help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the vulnerability","Final disposition of the vulnerability"]},{"rule":{"id":"VER-RPT-AVI","name":"Accepted Vulnerability Info","process":"VER","subset":"RPT","scope":"all","href":"/fedramp-20x/rules/ver/rpt-avi","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":null,"statement":"Providers MUST include the following information on accepted vulnerabilities when reporting on vulnerability detection and response activity:","items":["Provider's internally assigned tracking identifier","Time and source of the detection","Time of completed evaluation","Is it an internet-reachable vulnerability or not?","Is it a likely exploitable vulnerability or not?","Currently estimated Potential Agency Impact N-rating","Explanation of why this is an accepted vulnerability","Any supplementary information the provider determines will responsibly help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the accepted vulnerability"]}],"schemas":[{"name":"FedRAMP Vulnerability Detail Report (VER-RPT-VDT)","url":"https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json"},{"name":"FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)","url":"https://fedramp.gov/schemas/fedramp-accepted-vulnerability-info-schema-2026-06-24.json"},{"name":"FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)","url":"https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json"}]},"incidents":{"iri":{"rule":{"id":"VER-TFR-IRI","name":"Internet-Reachable Incidents","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-iri","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"byClass":[{"serviceClass":"a","force":"MAY","timeframe":null,"statement":"Providers with Class A Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below."},{"serviceClass":"b","force":"MAY","timeframe":null,"statement":"Providers with Class B Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below."},{"serviceClass":"c","force":"SHOULD","timeframe":null,"statement":"Providers with Class C Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below."},{"serviceClass":"d","force":"SHOULD","timeframe":null,"statement":"Providers with Class D Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below."}],"condition":{"internetReachable":true,"comparator":">","rating":3,"untilRating":3}},"nri":{"rule":{"id":"VER-TFR-NRI","name":"Non-Internet-Reachable Incidents","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-nri","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"byClass":[{"serviceClass":"a","force":"MAY","timeframe":null,"statement":"Providers with Class A Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below."},{"serviceClass":"b","force":"MAY","timeframe":null,"statement":"Providers with Class B Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below."},{"serviceClass":"c","force":"MAY","timeframe":null,"statement":"Providers with Class C Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below."},{"serviceClass":"d","force":"SHOULD","timeframe":null,"statement":"Providers with Class D Certifications SHOULD treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below."}],"condition":{"internetReachable":false,"comparator":"=","rating":5,"untilRating":4}}},"accepted":{"rule":{"id":"VER-TFR-MAV","name":"Mark Accepted Vulnerabilities","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-mav","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":{"type":"days","num":192},"statement":"Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability."},"kev":{"rule":{"id":"VDR-TFR-KEV","name":"Remediate KEVs","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-kev","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"force":"SHOULD","timeframe":null,"statement":"Providers SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA.","reference":{"name":"CISA BOD 26-04","url":"https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"}},"painLevels":[{"rating":0,"label":"N0","text":"Exploitation is extremely unlikely to have any adverse effects on agencies that use the cloud service offering."},{"rating":1,"label":"N1","text":"Exploitation could be expected to have minimal customer effects on one or more agencies that use the cloud service offering."},{"rating":2,"label":"N2","text":"Exploitation could be expected to have narrow customer effects on one or more agencies that use the cloud service offering."},{"rating":3,"label":"N3","text":"Exploitation could be expected to have a disruptive customer effect on one agency that uses the cloud service offering."},{"rating":4,"label":"N4","text":"Exploitation could be expected to have a debilitating customer effect on one agency that uses the cloud service offering OR a disruptive customer effect on more than one federal agency that uses the cloud service offering."},{"rating":5,"label":"N5","text":"Exploitation could be expected to have a debilitating customer effect on more than one agency that uses the cloud service offering."}],"glossary":[{"id":"FRD-IRV","term":"Internet-Reachable Vulnerability (IRV)","slug":"internet-reachable-vulnerability-irv","href":"/fedramp-20x/glossary/internet-reachable-vulnerability-irv","definition":"A vulnerability in a machine-based information resource that might be exploited or otherwise triggered by a payload originating from a source on the public internet."},{"id":"FRD-LEV","term":"Likely Exploitable Vulnerability (LEV)","slug":"likely-exploitable-vulnerability-lev","href":"/fedramp-20x/glossary/likely-exploitable-vulnerability-lev","definition":"A vulnerability that is not fully mitigated AND is reachable by a likely threat actor; AND a likely threat actor with knowledge of the vulnerability would likely gain unauthorized access, cause harm, disrupt operations, or otherwise have an undesired adverse impact within the cloud service offering by exploiting the vulnerability."},{"id":"FRD-PAI","term":"Potential Agency Impact","slug":"potential-agency-impact","href":"/fedramp-20x/glossary/potential-agency-impact","definition":"The estimated cumulative effect of unauthorized access, disruption, harm, or other adverse impacts to all agencies using the cloud service that are likely to result from security incidents or the exploitation of vulnerabilities in the cloud service offering; as estimated following appropriate FedRAMP rules to calculate the Potential Agency Impact N-rating (PAIN)."},{"id":"FRD-PMV","term":"Partially Mitigated Vulnerability","slug":"partially-mitigated-vulnerability","href":"/fedramp-20x/glossary/partially-mitigated-vulnerability","definition":"A vulnerability where the likelihood or Potential Agency Impact N-rating has been reduced from the original evaluation but the risk of exploitation still exists and the vulnerability is still detected."},{"id":"FRD-FMV","term":"Fully Mitigated Vulnerability","slug":"fully-mitigated-vulnerability","href":"/fedramp-20x/glossary/fully-mitigated-vulnerability","definition":"A vulnerability where the likelihood of exploitation or Potential Agency Impact N-rating has been reduced from the original evaluation until either are negligible, but the vulnerability is still detected."},{"id":"FRD-RMV","term":"Remediated Vulnerability","slug":"remediated-vulnerability","href":"/fedramp-20x/glossary/remediated-vulnerability","definition":"A vulnerability that has been neutralized or eliminated and is no longer detected."},{"id":"FRD-ACV","term":"Accepted Vulnerability","slug":"accepted-vulnerability","href":"/fedramp-20x/glossary/accepted-vulnerability","definition":"A vulnerability that the provider does not intend to fully mitigate or remediate, OR that has not or will not be fully mitigated or remediated within the maximum overdue period in FedRAMP Vulnerability Detection and Response rules."},{"id":"FRD-ODV","term":"Overdue Vulnerability","slug":"overdue-vulnerability","href":"/fedramp-20x/glossary/overdue-vulnerability","definition":"A vulnerability that the provider intends to fully mitigate or remediate but has not or will not do so within the time frames recommended or required by FedRAMP."},{"id":"FRD-FRI","term":"FedRAMP Reportable Incident","slug":"fedramp-reportable-incident","href":"/fedramp-20x/glossary/fedramp-reportable-incident","definition":"An incident that affects the confidentiality or integrity of federal customer data or is likely to affect the confidentiality or integrity of federal customer data."},{"id":"FRD-KEV","term":"Known Exploited Vulnerability (KEV)","slug":"known-exploited-vulnerability-kev","href":"/fedramp-20x/glossary/known-exploited-vulnerability-kev","definition":"Has the meaning given in CISA Binding Operational Directive 26-04, which is any vulnerability identified in CISA's Known Exploited Vulnerabilities catalog."}],"calculator":{"evaluation":{"rule":{"id":"VER-TFR-EVU","name":"Evaluate Vulnerabilities Quickly","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-evu","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"byClass":[{"serviceClass":"a","force":"SHOULD","timeframe":{"type":"days","num":14},"statement":"Providers with Class A Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 14 days of detection."},{"serviceClass":"b","force":"SHOULD","timeframe":{"type":"days","num":7},"statement":"Providers with Class B Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 7 days of detection."},{"serviceClass":"c","force":"SHOULD","timeframe":{"type":"days","num":5},"statement":"Providers with Class C Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 5 days of detection."},{"serviceClass":"d","force":"SHOULD","timeframe":{"type":"days","num":2},"statement":"Providers with Class D Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 2 days of detection."}]},"remediation":{"rule":{"id":"VDR-TFR-PVR","name":"Mitigation and Remediation Expectations","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-pvr","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"columns":[{"key":"irv_lev","label":"Internet-reachable and likely exploitable (IRV + LEV)","description":"Internet-Reachable Vulnerability + Likely Exploitable Vulnerability"},{"key":"nirv_lev","label":"Not internet-reachable, likely exploitable (NIRV + LEV)","description":"Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability"},{"key":"nlev","label":"Not likely exploitable (NLEV)","description":"Not Likely Exploitable Vulnerability"}],"ratings":["5","4","3","2","1"],"byClass":[{"serviceClass":"a","force":"SHOULD","timeframe":null,"statement":"Providers with Class A Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability.","matrix":{"1":{},"2":{"irv_lev":{"type":"days","num":96},"nirv_lev":{"type":"days","num":160},"nlev":{"type":"days","num":192}},"3":{"irv_lev":{"type":"days","num":32},"nirv_lev":{"type":"days","num":64},"nlev":{"type":"days","num":192}},"4":{"irv_lev":{"type":"days","num":8},"nirv_lev":{"type":"days","num":32},"nlev":{"type":"days","num":64}},"5":{"irv_lev":{"type":"days","num":4},"nirv_lev":{"type":"days","num":8},"nlev":{"type":"days","num":32}}}},{"serviceClass":"b","force":"SHOULD","timeframe":null,"statement":"Providers with Class B Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","matrix":{"1":{},"2":{"irv_lev":{"type":"days","num":96},"nirv_lev":{"type":"days","num":160},"nlev":{"type":"days","num":192}},"3":{"irv_lev":{"type":"days","num":32},"nirv_lev":{"type":"days","num":64},"nlev":{"type":"days","num":192}},"4":{"irv_lev":{"type":"days","num":8},"nirv_lev":{"type":"days","num":32},"nlev":{"type":"days","num":64}},"5":{"irv_lev":{"type":"days","num":4},"nirv_lev":{"type":"days","num":8},"nlev":{"type":"days","num":32}}}},{"serviceClass":"c","force":"SHOULD","timeframe":null,"statement":"Providers with Class C Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","matrix":{"1":{},"2":{"irv_lev":{"type":"days","num":48},"nirv_lev":{"type":"days","num":128},"nlev":{"type":"days","num":192}},"3":{"irv_lev":{"type":"days","num":16},"nirv_lev":{"type":"days","num":32},"nlev":{"type":"days","num":128}},"4":{"irv_lev":{"type":"days","num":4},"nirv_lev":{"type":"days","num":8},"nlev":{"type":"days","num":64}},"5":{"irv_lev":{"type":"days","num":2},"nirv_lev":{"type":"days","num":4},"nlev":{"type":"days","num":16}}}},{"serviceClass":"d","force":"SHOULD","timeframe":null,"statement":"Providers with Class D Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the maximum timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","matrix":{"1":{},"2":{"irv_lev":{"type":"days","num":24},"nirv_lev":{"type":"days","num":96},"nlev":{"type":"days","num":192}},"3":{"irv_lev":{"type":"days","num":8},"nirv_lev":{"type":"days","num":16},"nlev":{"type":"days","num":64}},"4":{"irv_lev":{"type":"days","num":2},"nirv_lev":{"type":"days","num":8},"nlev":{"type":"days","num":32}},"5":{"irv_lev":{"type":"hours","num":12},"nirv_lev":{"type":"days","num":1},"nlev":{"type":"days","num":8}}}}]},"incidents":{"iri":{"rule":{"id":"VER-TFR-IRI","name":"Internet-Reachable Incidents","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-iri","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"byClass":[{"serviceClass":"a","force":"MAY","timeframe":null,"statement":"Providers with Class A Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below."},{"serviceClass":"b","force":"MAY","timeframe":null,"statement":"Providers with Class B Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below."},{"serviceClass":"c","force":"SHOULD","timeframe":null,"statement":"Providers with Class C Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below."},{"serviceClass":"d","force":"SHOULD","timeframe":null,"statement":"Providers with Class D Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below."}],"condition":{"internetReachable":true,"comparator":">","rating":3,"untilRating":3}},"nri":{"rule":{"id":"VER-TFR-NRI","name":"Non-Internet-Reachable Incidents","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-nri","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"byClass":[{"serviceClass":"a","force":"MAY","timeframe":null,"statement":"Providers with Class A Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below."},{"serviceClass":"b","force":"MAY","timeframe":null,"statement":"Providers with Class B Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below."},{"serviceClass":"c","force":"MAY","timeframe":null,"statement":"Providers with Class C Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below."},{"serviceClass":"d","force":"SHOULD","timeframe":null,"statement":"Providers with Class D Certifications SHOULD treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below."}],"condition":{"internetReachable":false,"comparator":"=","rating":5,"untilRating":4}}},"accepted":{"rule":{"id":"VER-TFR-MAV","name":"Mark Accepted Vulnerabilities","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-mav","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":{"type":"days","num":192},"statement":"Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability."},"kev":{"rule":{"id":"VDR-TFR-KEV","name":"Remediate KEVs","process":"VDR","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/vdr/tfr-kev","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"force":"SHOULD","timeframe":null,"statement":"Providers SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA.","reference":{"name":"CISA BOD 26-04","url":"https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"}},"monthlyReport":{"rule":{"id":"VER-TFR-MHR","name":"Monthly Activity Report","process":"VER","subset":"TFR","scope":"all","href":"/fedramp-20x/rules/ver/tfr-mhr","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},"force":"MUST","timeframe":{"type":"months","num":1},"statement":"Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly."},"machineVerification":{"20x":{"rule":{"id":"VDR-TFR-MVX","name":"Persistent Machine Verification and Validation for 20x","process":"VDR","subset":"TFR","scope":"20x","href":"/fedramp-20x/rules/vdr/tfr-mvx","atlas":true,"sourceUrl":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},"byClass":[{"serviceClass":"a","force":"SHOULD","timeframe":{"type":"months","num":1},"statement":"Providers of FedRAMP 20x Class A offerings SHOULD verify and validate the status of machine-based information resources at least once every month."},{"serviceClass":"b","force":"MUST","timeframe":{"type":"days","num":7},"statement":"Providers of FedRAMP 20x Class B offerings MUST verify and validate the status of machine-based information resources at least once every 7 days."},{"serviceClass":"c","force":"MUST","timeframe":{"type":"days","num":3},"statement":"Providers of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days."}]},"rev5":{"rule":{"id":"VDR-TFR-MVF","name":"Persistent Machine Verification and Validation for Rev5","process":"VDR","subset":"TFR","scope":"rev5","href":"/consolidated-rules?rule=VDR-TFR-MVF","atlas":false,"sourceUrl":"https://github.com/FedRAMP/rules/blob/a89d78477ddea98dc57eca24f5007794c2b4eeb6/fedramp-consolidated-rules.json"},"byClass":[{"serviceClass":"b","force":"SHOULD","timeframe":{"type":"months","num":1},"statement":"Providers of FedRAMP Rev5 Class B offerings SHOULD verify and validate the status of machine-based information resources at least once every month."},{"serviceClass":"c","force":"MUST","timeframe":{"type":"months","num":1},"statement":"Providers of FedRAMP Rev5 Class C offerings MUST verify and validate the status of machine-based information resources at least once every month."},{"serviceClass":"d","force":"MUST","timeframe":{"type":"months","num":1},"statement":"Providers of FedRAMP Rev5 Class D offerings MUST verify and validate the status of machine-based information resources at least once every month."}]}},"painLevels":[{"rating":0,"label":"N0","text":"Exploitation is extremely unlikely to have any adverse effects on agencies that use the cloud service offering."},{"rating":1,"label":"N1","text":"Exploitation could be expected to have minimal customer effects on one or more agencies that use the cloud service offering."},{"rating":2,"label":"N2","text":"Exploitation could be expected to have narrow customer effects on one or more agencies that use the cloud service offering."},{"rating":3,"label":"N3","text":"Exploitation could be expected to have a disruptive customer effect on one agency that uses the cloud service offering."},{"rating":4,"label":"N4","text":"Exploitation could be expected to have a debilitating customer effect on one agency that uses the cloud service offering OR a disruptive customer effect on more than one federal agency that uses the cloud service offering."},{"rating":5,"label":"N5","text":"Exploitation could be expected to have a debilitating customer effect on more than one agency that uses the cloud service offering."}]},"sources":[{"name":"FedRAMP: Vulnerability Detection and Response rules","url":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/"},{"name":"FedRAMP: Vulnerability Evaluation and Reporting rules","url":"https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/"},{"name":"FedRAMP/rules on GitHub, release 2026.10.13.01","url":"https://github.com/FedRAMP/rules/blob/a89d78477ddea98dc57eca24f5007794c2b4eeb6/fedramp-consolidated-rules.json"},{"name":"FedRAMP NTC-0014: FedRAMP Response to CISA BOD 26-04","url":"https://www.fedramp.gov/notices/0014"},{"name":"FedRAMP RFC-0036: FedRAMP 20x Class D Cloud-Hosted Pilot Requirements","url":"https://www.fedramp.gov/rfcs/0036/"},{"name":"CISA BOD 26-04","url":"https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"},{"name":"FedRAMP schema: FedRAMP Vulnerability Detail Report (VER-RPT-VDT)","url":"https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json"},{"name":"FedRAMP schema: FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)","url":"https://fedramp.gov/schemas/fedramp-accepted-vulnerability-info-schema-2026-06-24.json"},{"name":"FedRAMP schema: FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)","url":"https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json"}]}