VER-RPT-AVI Accepted Vulnerability Info

Providers MUST include the following information on accepted vulnerabilities when reporting on vulnerability detection and response activity:

• Provider's internally assigned tracking identifier
• Time and source of the detection
• Time of completed evaluation
• Is it an internet-reachable vulnerability or not?
• Is it a likely exploitable vulnerability or not?
• Currently estimated Potential Agency Impact N-rating
• Explanation of why this is an accepted vulnerability
• Any supplementary information the provider determines will responsibly help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the accepted vulnerability

Artifacts

• A recent vulnerability report or a sample vulnerability report

Schema: FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)

Defined terms: Accepted Vulnerability, Cloud Service Offering, Federal Customer Data, Internet-Reachable Vulnerability (IRV), Likely, Likely Exploitable Vulnerability (LEV), Potential Agency Impact, Responsibly, Vulnerability, Vulnerability Detection, Vulnerability Response

1. Resumen

1.1 Referencias

• FRD-ACV Accepted Vulnerability
• FRD-CSO Cloud Service Offering
• FRD-FCD Federal Customer Data
• FRD-IRV Internet-Reachable Vulnerability (IRV)
• FRD-LKY Likely
• FRD-LEV Likely Exploitable Vulnerability (LEV)
• FRD-PAI Potential Agency Impact
• FRD-RSP Responsibly
• FRD-VUL Vulnerability
• FRD-VLD Vulnerability Detection
• FRD-VLR Vulnerability Response

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.