+VDR-TFR Timeframes
---+VDR-TFR-NMV Non-Machine Verification and Validation
---+VDR-TFR-PDD Persistent Drift Detection
---+VDR-TFR-PCD Persistently Complete Detection
---+VDR-TFR-PVR Mitigation and Remediation Expectations
---+VDR-TFR-RMN Remaining Vulnerabilities
---+VDR-TFR-KEV Remediate KEVs
---+VDR-TFR-PSD Persistent Sample Detection
---+VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
---+VDR-TFR-MVF Persistent Machine Verification and Validation for Rev5
|
VDR-TFR Timeframes
These rules apply to timeframes for vulnerability detection and response. - Types: 20x, Rev5
- Paths: Program, Agency
- Classes: B, C, D
- Affects: Providers
1. Yleiskatsaus
| Otsikko |
Standardi |
|
VDR-TFR-NMV Non-Machine Verification and Validation
|
Providers MUST verify and validate the status of non-machine-based information resources at least once every 3 months. Timeframe: 3 months Defined terms: Information Resource, Machine-Based (Information Resources), Validation, Verification
|
|
VDR-TFR-PDD Persistent Drift Detection
|
Class AProviders with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 3 months. Timeframe: 3 months Class BProviders with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every month. Timeframe: 1 month Class CProviders with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days. Timeframe: 14 days Class DProviders with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 7 days. Timeframe: 7 days NIST SP 800-53 Rev. 5 controls: SI-4(22), SI-7, SI-7(1) Defined terms: Drift, Information Resource, Likely, Persistently, Vulnerability, Vulnerability Detection
|
|
VDR-TFR-PCD Persistently Complete Detection
|
Class AProviders with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months. Timeframe: 6 months Class BProviders with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months. Timeframe: 6 months Class CProviders with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month. Timeframe: 1 month Class DProviders with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month. Timeframe: 1 month Defined terms: Drift, Information Resource, Likely, Persistently, Vulnerability, Vulnerability Detection
|
|
VDR-TFR-PVR Mitigation and Remediation Expectations
|
Class AProviders with Class A Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability. Timeframes by impact level| Level | Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Likely Exploitable Vulnerability |
|---|
| 1 | | | | | 2 | 96 days | 160 days | 192 days | | 3 | 32 days | 64 days | 192 days | | 4 | 8 days | 32 days | 64 days | | 5 | 4 days | 8 days | 32 days |
Class BProviders with Class B Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability: Timeframes by impact level| Level | Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Likely Exploitable Vulnerability |
|---|
| 1 | | | | | 2 | 96 days | 160 days | 192 days | | 3 | 32 days | 64 days | 192 days | | 4 | 8 days | 32 days | 64 days | | 5 | 4 days | 8 days | 32 days |
Class CProviders with Class C Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability: Timeframes by impact level| Level | Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Likely Exploitable Vulnerability |
|---|
| 1 | | | | | 2 | 48 days | 128 days | 192 days | | 3 | 16 days | 32 days | 128 days | | 4 | 4 days | 8 days | 64 days | | 5 | 2 days | 4 days | 16 days |
Class DProviders with Class D Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the maximum timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability: Timeframes by impact level| Level | Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Likely Exploitable Vulnerability |
|---|
| 1 | | | | | 2 | 24 days | 96 days | 192 days | | 3 | 8 days | 16 days | 64 days | | 4 | 2 days | 8 days | 32 days | | 5 | 12 hours | 1 day | 8 days |
Related rules: VER-EVA-EPA NIST SP 800-53 Rev. 5 controls: SI-2(3) Defined terms: Fully Mitigated Vulnerability, Likely, Partially Mitigated Vulnerability, Potential Agency Impact, Remediated Vulnerability, Vulnerability
|
|
VDR-TFR-RMN Remaining Vulnerabilities
|
Providers SHOULD mitigate or remediate remaining vulnerabilities during routine operations as determined necessary by the provider. Defined terms: Vulnerability
|
|
VDR-TFR-KEV Remediate KEVs
|
Providers SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA. Reference: CISA BOD 26-04 Defined terms: Known Exploited Vulnerability (KEV), Vulnerability
|
|
VDR-TFR-PSD Persistent Sample Detection
|
Class AProviders with Class A Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 14 days. Timeframe: 14 days Class BProviders with Class B Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 7 days. Timeframe: 7 days Class CProviders with Class C Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days. Timeframe: 3 days Class DProviders with Class D Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once per day. Timeframe: 1 day Defined terms: Information Resource, Machine-Based (Information Resources), Persistently, Vulnerability, Vulnerability Detection
|
|
VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
|
Class AProviders of FedRAMP 20x Class A offerings SHOULD verify and validate the status of machine-based information resources at least once every month. Timeframe: 1 month Class BProviders of FedRAMP 20x Class B offerings MUST verify and validate the status of machine-based information resources at least once every 7 days. Timeframe: 7 days Class CProviders of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days. Timeframe: 3 days Defined terms: Information Resource, Machine-Based (Information Resources), Validation, Verification
|
|
VDR-TFR-MVF Persistent Machine Verification and Validation for Rev5
|
Class BProviders of FedRAMP Rev5 Class B offerings SHOULD verify and validate the status of machine-based information resources at least once every month. Timeframe: 1 month Class CProviders of FedRAMP Rev5 Class C offerings MUST verify and validate the status of machine-based information resources at least once every month. Timeframe: 1 month Class DProviders of FedRAMP Rev5 Class D offerings MUST verify and validate the status of machine-based information resources at least once every month. Timeframe: 1 month Defined terms: Information Resource, Machine-Based (Information Resources), Validation, Verification
|
1.1 Viittaukset
1.2 Tunnistetut vaatimukset
1.3 Liittyvät säädökset
2. Tunnistetut vaatimukset
Vaatimukset
| Lähde |
Vaatimus |
3. Liittyvät säädökset
- FedRAMP Consolidated Rules -
EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.
DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.
|