VER-RPT-VDT Vulnerability Details

Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability:

• Provider's internally assigned tracking identifier
• Time and source of the detection
• Time of completed evaluation
• Is it an internet-reachable vulnerability or not?
• Is it a likely exploitable vulnerability or not?
• Historically and currently estimated Potential Agency Impact N-rating of exploitation
• Time and Potential Agency Impact N-rating of each completed and evaluated reduction in Potential Agency Impact N-rating
• Estimated time and target Potential Agency Impact N-rating of next reduction in Potential Agency Impact N-rating
• Is it currently or is it likely to become an overdue vulnerability or not? If so, explain.
• Any supplementary information the provider responsibly determines will help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the vulnerability
• Final disposition of the vulnerability

Artifacts

• A recent vulnerability report or a sample vulnerability report

Schema: FedRAMP Vulnerability Detail Report (VER-RPT-VDT)

NIST SP 800-53 Rev. 5 controls: SI-2(3)

Defined terms: Accepted Vulnerability, Cloud Service Offering, Federal Customer Data, Internet-Reachable Vulnerability (IRV), Likely, Likely Exploitable Vulnerability (LEV), Overdue Vulnerability, Potential Agency Impact, Responsibly, Vulnerability, Vulnerability Detection, Vulnerability Response

1. Преглед

1.1 Препратки

• SI-02(03) Time to Remediate Flaws and Benchmarks for Corrective Actions
• FRD-ACV Accepted Vulnerability
• FRD-CSO Cloud Service Offering
• FRD-FCD Federal Customer Data
• FRD-IRV Internet-Reachable Vulnerability (IRV)
• FRD-LKY Likely
• FRD-LEV Likely Exploitable Vulnerability (LEV)
• FRD-ODV Overdue Vulnerability
• FRD-PAI Potential Agency Impact
• FRD-RSP Responsibly
• FRD-VUL Vulnerability
• FRD-VLD Vulnerability Detection
• FRD-VLR Vulnerability Response

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

3. Свързани регулации

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.