---
tags:
  - 20x
  - FedRAMP
  - Federal Agencies
  - Cloud Service Providers
  - Rules
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Vulnerability Evaluation and Reporting

The Vulnerability Evaluation and Reporting rules require cloud service providers to determine when vulnerabilities are likely to impact federal customers and report the status of such vulnerabilities to all necessary parties.

**Subsets**

- [FedRAMP Responsibilities](#fedramp-responsibilities)
- [Agency Guidance](#agency-guidance)
- [Evaluation](#evaluation)
- [Reporting](#reporting)
- [Timeframes](#timeframes)

!!! info "Effective Date(s) & Overall Applicability for 20x"
    - **Required** (Mandated by CISA BOD 26-04)
    - **Optional Adoption:** 2026-07-04
    - **Obtain:** 2026-12-07
    - **Maintain:** 2026-12-07
    - **Grace Ends:** 2027-03-07



---


## FedRAMP Responsibilities {#fedramp-responsibilities}

These rules apply to FedRAMP when setting expectations for specific cloud service providers.

<div class="subset-applicability" role="group" aria-label="Applicability">
<span class="subset-applicability__group subset-applicability__group--types"><span class="subset-applicability__label">Type:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">20x</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--paths"><span class="subset-applicability__label">Path:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Program</span><span class="subset-applicability__tag">Agency</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">Class:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--affects"><span class="subset-applicability__label">Audience:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">FedRAMP</span></span></span>
</div>

### Additional Requirements

??? abstract "VER-FRP-ARP"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    FedRAMP MAY require providers to share additional vulnerability information, alternative reports, or to report at an alternative frequency as a condition of a FedRAMP Corrective Action Plan or other agreements with federal agencies.


    ---
    **Terms:** [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### Sensitive Details

??? abstract "VER-FRP-ADV"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    FedRAMP MAY require providers to share additional information or details about vulnerabilities, including sensitive information that would likely lead to exploitation, as part of review, response or investigation by necessary parties.


    ---
    **Terms:** [Likely](../../../definitions/#likely){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
## Agency Guidance {#agency-guidance}

These rules for agencies apply to all agencies using a FedRAMP Certification.

<div class="subset-applicability" role="group" aria-label="Applicability">
<span class="subset-applicability__group subset-applicability__group--types"><span class="subset-applicability__label">Type:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">20x</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--paths"><span class="subset-applicability__label">Path:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Program</span><span class="subset-applicability__tag">Agency</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">Class:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--affects"><span class="subset-applicability__label">Audience:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Agencies</span></span></span>
</div>

### Review Vulnerability Reports

??? abstract "VER-AGM-RVR"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Agencies SHOULD review the information provided in vulnerability reports at appropriate and reasonable intervals commensurate with the expectations and risk posture indicated by their Authorization to Operate, and SHOULD use automated processing and filtering of machine readable information from cloud service providers.


    ---

    _**Note:** FedRAMP recommends that agencies only review overdue and accepted vulnerabilities Potential Agency Impact N-rating > 2 unless the cloud service provider recommends mitigations or the service is included in a higher risk federal information system. Furthermore, accepted vulnerabilities generally only need to be reviewed when they are added or during an updated risk assessment due to changes in the agency's use or authorization._

    ---
    **Terms:** [Accepted Vulnerability](../../../definitions/#accepted-vulnerability){ data-preview }, [Potential Agency Impact](../../../definitions/#potential-agency-impact){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### Maintain Agency Plans of Action and Milestones

??? abstract "VER-AGM-MAP"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Agencies SHOULD use vulnerability information reported by the Provider to maintain Plans of Action and Milestones for agency security programs when relevant according to agency security policies (such as if the agency takes action to mitigate the risk of exploitation or authorized the continued use of a cloud service with accepted vulnerabilities that put agency information systems at risk).


    ---
    **Terms:** [Accepted Vulnerability](../../../definitions/#accepted-vulnerability){ data-preview }, [FedRAMP Certified](../../../definitions/#fedramp-certified){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
## Evaluation {#evaluation}

These rules apply to the evaluation of vulnerabilities.

<div class="subset-applicability" role="group" aria-label="Applicability">
<span class="subset-applicability__group subset-applicability__group--types"><span class="subset-applicability__label">Type:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">20x</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--paths"><span class="subset-applicability__label">Path:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Program</span><span class="subset-applicability__tag">Agency</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">Class:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--affects"><span class="subset-applicability__label">Audience:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Providers</span></span></span>
</div>

### Evaluate Exploitability

??? abstract "VER-EVA-ELX"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are likely exploitable vulnerabilities.


    ---

    _**Notes:**_

    - _The simple reality is that most traditional vulnerabilities discovered by scanners or during assessment are not likely to be exploitable; exploitation typically requires an unrealistic set of circumstances that will not occur during normal operation. The likelihood of exploitation will vary depending on so many factors that FedRAMP will not recommend a specific framework for approaching this beyond these rules._
    - _The proof, ultimately, is in the pudding - providers who regularly evaluate vulnerabilities as not likely exploitable without careful consideration are more likely to suffer from an adverse impact where the root cause was an exploited vulnerability that was improperly evaluated. If done recklessly or deliberately, such actions will have a negative impact on a provider's FedRAMP Certification._
    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Likely Exploitable Vulnerability (LEV)](../../../definitions/#likely-exploitable-vulnerability-lev){ data-preview }, [Regularly](../../../definitions/#regularly){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Evaluate Internet-Reachability

??? abstract "VER-EVA-EIR"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are internet-reachable vulnerabilities.


    ---

    _**Notes:**_

    - _FedRAMP focuses on internet-reachable (rather than internet-accessible) to ensure that any service that might receive a payload from the internet is prioritized if that service has a vulnerability that can be triggered by processing the data in the payload._
    - _The simplest way to prevent exploitation of internet-reachable vulnerabilities is to intercept, inspect, filter, sanitize, reject, or otherwise deflect triggering payloads before they are processed by the vulnerable resource; once this prevention is in place the vulnerability should no longer be considered an internet-reachable vulnerability._
    - _A classic example of an internet-reachable vulnerability on systems that are not typically internet-accessible is [SQL injection](https://en.wikipedia.org/wiki/SQL_injection), where an application stack behind a load balancer and firewall with no ability to route traffic to or from the internet can receive a payload indirectly from the internet that triggers the manipulation or compromise of data in a database that can only be accessed by an authorized connection from the application server on a private network._
    - _Another simple example is the infamous Log4Shell (https://en.wikipedia.org/wiki/Log4Shell) vulnerability from 2021, where exploitation was possible via vulnerable internet-reachable resources deep in the application stack that were often not internet-accessible themselves._
    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [FedRAMP Certified](../../../definitions/#fedramp-certified){ data-preview }, [Internet-Reachable Vulnerability (IRV)](../../../definitions/#internet-reachable-vulnerability-irv){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Estimate Potential Agency Impact

??? abstract "VER-EVA-EPA"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to estimate the potential agency impact of exploitation on government customers AND assign one of the following Potential Agency Impact N-ratings (PAIN):

    - **N1**: Exploitation could be expected to have minimal customer effects on one or more agencies that use the cloud service offering.
    - **N2**: Exploitation could be expected to have narrow customer effects on one or more agencies that use the cloud service offering.
    - **N3**: Exploitation could be expected to have a disruptive customer effect on one agency that uses the cloud service offering.
    - **N4**: Exploitation could be expected to have a debilitating customer effect on one agency that uses the cloud service offering OR a disruptive customer effect on more than one federal agency that uses the cloud service offering.
    - **N5**: Exploitation could be expected to have a debilitating customer effect on more than one agency that uses the cloud service offering.


    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [Debilitating Customer Effect](../../../definitions/#debilitating-customer-effect){ data-preview }, [Disruptive Customer Effect](../../../definitions/#disruptive-customer-effect){ data-preview }, [Minimal Customer Effect](../../../definitions/#minimal-customer-effect){ data-preview }, [Narrow Customer Effect](../../../definitions/#narrow-customer-effect){ data-preview }, [Potential Agency Impact](../../../definitions/#potential-agency-impact){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Assume It's Automatable

??? abstract "VER-EVA-AIA"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise.


    ---
    **Terms:** [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### Group Vulnerabilities

??? abstract "VER-EVA-GRV"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to identify logical groupings of affected information resources that may improve the efficiency and effectiveness of vulnerability response by consolidating further activity; FedRAMP Vulnerability Detection and Response rules are then applied to these consolidated groupings of vulnerabilities instead of each individual detected instance.


    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [Information Resource](../../../definitions/#information-resource){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Evaluate False Positives

??? abstract "VER-EVA-EFP"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are false positive vulnerabilities.


    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [False Positive Vulnerability](../../../definitions/#false-positive-vulnerability){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Evaluation Factors

??? abstract "VER-EVA-EFA"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers SHOULD consider at least the following factors when considering the context of the cloud service offering to evaluate detected vulnerabilities:

    1. **Criticality**: How important are the systems or information that might be impacted by the vulnerability?
    1. **Reachability**: How might a threat actor reach the vulnerability and how likely is that?
    1. **Exploitability**: How easy is it for a threat actor to exploit the vulnerability and how likely is that?
    1. **Detectability**: How easy is it for a threat actor to become aware of the vulnerability and how likely is that?
    1. **Prevalence**: How much of the cloud service offering is affected by the vulnerability?
    1. **Privilege**: How much privileged authority or access is granted or can be gained from exploiting the vulnerability?
    1. **Proximate Vulnerabilities**: How does this vulnerability interact with previously detected vulnerabilities, especially partially or fully mitigated vulnerabilities?
    1. **Known Threats**: How might already known threats leverage the vulnerability and how likely is that?


    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [Fully Mitigated Vulnerability](../../../definitions/#fully-mitigated-vulnerability){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
## Reporting {#reporting}

These rules apply to reporting related to vulnerability detection and response.

<div class="subset-applicability" role="group" aria-label="Applicability">
<span class="subset-applicability__group subset-applicability__group--types"><span class="subset-applicability__label">Type:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">20x</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--paths"><span class="subset-applicability__label">Path:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Program</span><span class="subset-applicability__tag">Agency</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">Class:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--affects"><span class="subset-applicability__label">Audience:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Providers</span></span></span>
</div>

### Persistent Reporting

??? abstract "VER-RPT-PER"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.



!!! schema "Related JSON Schema: [FedRAMP Vulnerability Detail Report (VER-RPT-VDT)](https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json)"


!!! quote ""
    Providers MUST report vulnerability detection and response activity (including persistent verification and validation) to all necessary parties persistently, summarizing ALL activity since the previous report; these reports are FedRAMP Certification Data and are subject to FedRAMP Certification Data Sharing rules.


    ---
    **Terms:** [All Necessary Parties](../../../definitions/#all-necessary-parties){ data-preview }, [Certification Data](../../../definitions/#certification-data){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }, [Validation](../../../definitions/#validation){ data-preview }, [Verification](../../../definitions/#verification){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Vulnerability Details

??? abstract "VER-RPT-VDT"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.



!!! schema "Related JSON Schema: [FedRAMP Vulnerability Detail Report (VER-RPT-VDT)](https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json)"


!!! quote ""
    Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability:

    1. Provider's internally assigned tracking identifier
    1. Time and source of the detection
    1. Time of completed evaluation
    1. Is it an internet-reachable vulnerability or not?
    1. Is it a likely exploitable vulnerability or not?
    1. Historically and currently estimated Potential Agency Impact N-rating of exploitation
    1. Time and Potential Agency Impact N-rating of each completed and evaluated reduction in Potential Agency Impact N-rating
    1. Estimated time and target Potential Agency Impact N-rating of next reduction in Potential Agency Impact N-rating
    1. Is it currently or is it likely to become an overdue vulnerability or not? If so, explain.
    1. Any supplementary information the provider responsibly determines will help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the vulnerability
    1. Final disposition of the vulnerability


    ---
    **Terms:** [Accepted Vulnerability](../../../definitions/#accepted-vulnerability){ data-preview }, [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [Federal Customer Data](../../../definitions/#federal-customer-data){ data-preview }, [Internet-Reachable Vulnerability (IRV)](../../../definitions/#internet-reachable-vulnerability-irv){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Likely Exploitable Vulnerability (LEV)](../../../definitions/#likely-exploitable-vulnerability-lev){ data-preview }, [Overdue Vulnerability](../../../definitions/#overdue-vulnerability){ data-preview }, [Potential Agency Impact](../../../definitions/#potential-agency-impact){ data-preview }, [Responsibly](../../../definitions/#responsibly){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Accepted Vulnerability Info

??? abstract "VER-RPT-AVI"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.



!!! schema "Related JSON Schema: [FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)](https://fedramp.gov/schemas/fedramp-accepted-vulnerability-info-schema-2026-06-24.json)"


!!! quote ""
    Providers MUST include the following information on accepted vulnerabilities when reporting on vulnerability detection and response activity:

    1. Provider's internally assigned tracking identifier
    1. Time and source of the detection
    1. Time of completed evaluation
    1. Is it an internet-reachable vulnerability or not?
    1. Is it a likely exploitable vulnerability or not?
    1. Currently estimated Potential Agency Impact N-rating
    1. Explanation of why this is an accepted vulnerability
    1. Any supplementary information the provider determines will responsibly help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the accepted vulnerability


    ---
    **Terms:** [Accepted Vulnerability](../../../definitions/#accepted-vulnerability){ data-preview }, [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [Federal Customer Data](../../../definitions/#federal-customer-data){ data-preview }, [Internet-Reachable Vulnerability (IRV)](../../../definitions/#internet-reachable-vulnerability-irv){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Likely Exploitable Vulnerability (LEV)](../../../definitions/#likely-exploitable-vulnerability-lev){ data-preview }, [Potential Agency Impact](../../../definitions/#potential-agency-impact){ data-preview }, [Responsibly](../../../definitions/#responsibly){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Responsible Disclosure

??? abstract "VER-RPT-NID"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers MUST NOT irresponsibly disclose specific sensitive information about vulnerabilities that would likely lead to exploitation, but MUST disclose sufficient information for informed risk-based decision-making to all necessary parties.


    ---

    _**Note:** This requirement will be superseded in the event of formal action related to an investigation or corrective action plan._

    ---
    **Terms:** [All Necessary Parties](../../../definitions/#all-necessary-parties){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### High-Level Overviews

??? abstract "VER-RPT-HLO"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers SHOULD include high-level overviews of ALL vulnerability detection and response activities conducted during this period for the cloud service offering; this includes vulnerability disclosure programs, bug bounty programs, penetration testing, assessments, etc.


    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Responsible Public Disclosure

??? abstract "VER-RPT-RPD"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers MAY responsibly disclose vulnerabilities publicly or with other parties if the provider determines doing so will NOT likely lead to exploitation.


    ---
    **Terms:** [Likely](../../../definitions/#likely){ data-preview }, [Responsibly](../../../definitions/#responsibly){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
## Timeframes {#timeframes}

These rules apply to timeframes for vulnerability detection and response.

<div class="subset-applicability" role="group" aria-label="Applicability">
<span class="subset-applicability__group subset-applicability__group--types"><span class="subset-applicability__label">Type:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">20x</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--paths"><span class="subset-applicability__label">Path:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Program</span><span class="subset-applicability__tag">Agency</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">Class:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--affects"><span class="subset-applicability__label">Audience:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Providers</span></span></span>
</div>

### Monthly Activity Report

??? abstract "VER-TFR-MHR"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly.

    **Timeframe:** 1 month


    ---
    **Terms:** [All Necessary Parties](../../../definitions/#all-necessary-parties){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Mark Accepted Vulnerabilities

??? abstract "VER-TFR-MAV"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.

    **Timeframe:** 192 days


    ---
    **Terms:** [Accepted Vulnerability](../../../definitions/#accepted-vulnerability){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### Historical Activity

??? abstract "VER-TFR-MRH"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.



!!! schema "Related JSON Schema: [FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)](https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json)"


!!! quote ""
    === "Class B"
        Providers with Class B Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every month.

        **Timeframe:** 1 month


    ---
    **Terms:** [All Necessary Parties](../../../definitions/#all-necessary-parties){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Evaluate Vulnerabilities Quickly

??? abstract "VER-TFR-EVU"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    === "Class B"
        Providers with Class B Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 7 days of detection.

        **Timeframe:** 7 days


    ---
    **Terms:** [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Internet-Reachable Incidents

??? abstract "VER-TFR-IRI"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    === "Class B"
        Providers with Class B Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.


    ---
    **Terms:** [FedRAMP Reportable Incident](../../../definitions/#fedramp-reportable-incident){ data-preview }, [Incident](../../../definitions/#incident){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Likely Exploitable Vulnerability (LEV)](../../../definitions/#likely-exploitable-vulnerability-lev){ data-preview }, [Partially Mitigated Vulnerability](../../../definitions/#partially-mitigated-vulnerability){ data-preview }, [Potential Agency Impact](../../../definitions/#potential-agency-impact){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### Non-Internet-Reachable Incidents

??? abstract "VER-TFR-NRI"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    === "Class B"
        Providers with Class B Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.


    ---
    **Terms:** [FedRAMP Reportable Incident](../../../definitions/#fedramp-reportable-incident){ data-preview }, [Incident](../../../definitions/#incident){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Likely Exploitable Vulnerability (LEV)](../../../definitions/#likely-exploitable-vulnerability-lev){ data-preview }, [Partially Mitigated Vulnerability](../../../definitions/#partially-mitigated-vulnerability){ data-preview }, [Potential Agency Impact](../../../definitions/#potential-agency-impact){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
