---
tags:
  - 20x
  - Rev5
  - Federal Agencies
  - Rules
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Vulnerability Evaluation and Reporting

The Vulnerability Evaluation and Reporting rules require cloud service providers to determine when vulnerabilities are likely to impact federal customers and report the status of such vulnerabilities to all necessary parties.

!!! info "Effective Date(s) & Overall Applicability for 20x and Rev5"
    - **Required** (Mandated by CISA BOD 26-04)
    - **Optional Adoption:** 2026-07-04
    - **Obtain:** 2026-12-07
    - **Maintain:** 2026-12-07
    - **Grace Ends:** 2027-03-07



---


## Agency Guidance {#agency-guidance}

These rules for agencies apply to all agencies using a FedRAMP Certification.

<div class="subset-applicability" role="group" aria-label="Applicability">
<span class="subset-applicability__group subset-applicability__group--types"><span class="subset-applicability__label">Type:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">20x</span><span class="subset-applicability__tag">Rev5</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--paths"><span class="subset-applicability__label">Path:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Program</span><span class="subset-applicability__tag">Agency</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">Class:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--affects"><span class="subset-applicability__label">Audience:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Agencies</span></span></span>
</div>

### Review Vulnerability Reports

??? abstract "VER-AGM-RVR"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Agencies SHOULD review the information provided in vulnerability reports at appropriate and reasonable intervals commensurate with the expectations and risk posture indicated by their Authorization to Operate, and SHOULD use automated processing and filtering of machine readable information from cloud service providers.


    ---

    _**Note:** FedRAMP recommends that agencies only review overdue and accepted vulnerabilities Potential Agency Impact N-rating > 2 unless the cloud service provider recommends mitigations or the service is included in a higher risk federal information system. Furthermore, accepted vulnerabilities generally only need to be reviewed when they are added or during an updated risk assessment due to changes in the agency's use or authorization._

    ---
    **Terms:** [Accepted Vulnerability](../../definitions/#accepted-vulnerability){ data-preview }, [Potential Agency Impact](../../definitions/#potential-agency-impact){ data-preview }, [Vulnerability](../../definitions/#vulnerability){ data-preview }
### Maintain Agency Plans of Action and Milestones

??? abstract "VER-AGM-MAP"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Agencies SHOULD use vulnerability information reported by the Provider to maintain Plans of Action and Milestones for agency security programs when relevant according to agency security policies (such as if the agency takes action to mitigate the risk of exploitation or authorized the continued use of a cloud service with accepted vulnerabilities that put agency information systems at risk).


    ---
    **Terms:** [Accepted Vulnerability](../../definitions/#accepted-vulnerability){ data-preview }, [FedRAMP Certified](../../definitions/#fedramp-certified){ data-preview }, [Vulnerability](../../definitions/#vulnerability){ data-preview }
