VDR-CSO General Provider Responsibilities

Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.

Warning: Vulnerability Detection and Response includes all efforts to identify weaknesses in a system and is NOT limited to traditional vulnerability scanning or testing. An out-of-date control statement in the Security Decision Record is a vulnerability that must be detected and remediated just like any other vulnerability.

Notes

FedRAMP's vulnerability detection (and response) rules are intended to set modern expectations for maintaining the security of a cloud service. Historical FedRAMP guidance on vulnerability scanning or continuous monitoring generally focused only on CVE-type vulnerabilities while leaving other types of vulnerabilities and exposures unaddressed.

Providers are encouraged to leverage their existing holistic security review, architecture review, and similar processes to meet these requirements. FedRAMP strongly discourages providers from implementing separate vulnerability detection and response processes for FedRAMP reporting that are operated by independent compliance branches unless these processes are consuming data directly from the areas of the cloud service that actively maintain it.

NIST SP 800-53 Rev. 5 controls: AU-5(2), AU-6, CA-8, CA-8(1), CA-8(2), RA-5, RA-5(2), RA-5(3), RA-5(4), SI-2, SI-3, SI-4(1), SI-4(12), SI-4(18), SI-4(22), SI-5(1)

Defined terms: Cloud Service Offering, FedRAMP Practices, Incident, Information Resource, Persistently, Promptly, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers MUST systematically, persistently, and promptly track, evaluate, monitor, mitigate, remediate, assess exploitation of, report, and otherwise manage all detected vulnerabilities within their cloud service offering; this process is called vulnerability response.

Notes

If it is not possible to fully mitigate vulnerabilities or remediate vulnerabilities, providers SHOULD instead partially mitigate vulnerabilities promptly, progressively, and persistently.

FedRAMP does not use the terms "mitigation" and "remediation" interchangeably. Mitigation is the process of reducing the risk and impact of a vulnerability through partial mitigation and even full mitigation; remediation is the process of entirely eliminating the vulnerability. A fully mitigated vulnerability will still exist (with negligible risk) until it has been remediated. This separation is based on the plain language definitions of these words.

Please refer to FedRAMP Definitions for strict interpretation in the FedRAMP context.

NIST SP 800-53 Rev. 5 controls: AU-5(2), IR-4(11), IR-9(3), RA-7, SI-2, SI-3

Defined terms: Cloud Service Offering, Fully Mitigated Vulnerability, Partially Mitigated Vulnerability, Persistently, Promptly, Remediated Vulnerability, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers MUST treat problems or failures with their vulnerability detection and response processes as vulnerabilities.

NIST SP 800-53 Rev. 5 controls: AU-5(2), SI-4, SI-4(1), SI-7(7)

Defined terms: Vulnerability, Vulnerability Detection, Vulnerability Response

Providers SHOULD make design and architecture decisions for their cloud service offering that mitigate the risk of vulnerabilities by default AND decrease the risk and complexity of vulnerability detection and response.

Defined terms: Cloud Service Offering, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers SHOULD use automated services to improve and streamline vulnerability detection and response.

NIST SP 800-53 Rev. 5 controls: RA-5, SI-2(2), SI-3, SI-4(2), SI-4(5)

Defined terms: Vulnerability, Vulnerability Detection, Vulnerability Response

Providers SHOULD automatically perform vulnerability detection on representative samples of new or significantly changed information resources.

NIST SP 800-53 Rev. 5 controls: RA-5

Defined terms: Information Resource, Vulnerability, Vulnerability Detection

Providers SHOULD NOT weaken the security of information resources to facilitate vulnerability scanning, detection, or assessment activities.

NIST SP 800-53 Rev. 5 controls: RA-5(5), SI-2

Defined terms: Information Resource, Vulnerability, Vulnerability Detection

Providers SHOULD NOT deploy or otherwise activate new machine-based information resources with Known Exploited Vulnerabilities.

NIST SP 800-53 Rev. 5 controls: RA-5, SI-5

Defined terms: Information Resource, Known Exploited Vulnerability (KEV), Machine-Based (Information Resources), Vulnerability

Providers MAY sample effectively identical information resources, especially machine-based information resources, when performing vulnerability detection UNLESS doing so would decrease the efficiency or effectiveness of vulnerability detection.

NIST SP 800-53 Rev. 5 controls: RA-5(3), RA-5(5)

Defined terms: Information Resource, Machine-Based (Information Resources), Vulnerability, Vulnerability Detection