VER-TFR Timeframes

Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly.

Timeframe: 1 month

Artifacts

• A recent vulnerability report or a sample vulnerability report

Defined terms: All Necessary Parties, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.

Timeframe: 192 days

Defined terms: Accepted Vulnerability, Vulnerability

Class A

Providers with Class A Certifications MAY make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information MAY be updated persistently, at least once every month.

Timeframe: 1 month

Artifacts

• URL and access instructions for historical vulnerability detection and response activity in machine readable format

Class B

Providers with Class B Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every month.

Timeframe: 1 month

Artifacts

• URL and access instructions for historical vulnerability detection and response activity in machine readable format
• or an explanation of why machine readable content is not being provided

Class C

Providers with Class C Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 14 days.

Timeframe: 14 days

Artifacts

• URL and access instructions for historical vulnerability detection and response activity in machine readable format
• or an explanation of why machine readable content is not being provided

Class D

Providers with Class D Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 7 days.

Timeframe: 7 days

Artifacts

• URL and access instructions for historical vulnerability detection and response activity in machine readable format
• or an explanation of why machine readable content is not being provided

Schema: FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)

Defined terms: All Necessary Parties, Persistently, Vulnerability, Vulnerability Detection, Vulnerability Response

Class A

Providers with Class A Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 14 days of detection.

Timeframe: 14 days

Class B

Providers with Class B Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 7 days of detection.

Timeframe: 7 days

Class C

Providers with Class C Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 5 days of detection.

Timeframe: 5 days

Class D

Providers with Class D Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 2 days of detection.

Timeframe: 2 days

Defined terms: Vulnerability, Vulnerability Detection

Class A

Providers with Class A Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.

Class B

Providers with Class B Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.

Class C

Providers with Class C Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.

Class D

Providers with Class D Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.

Defined terms: FedRAMP Reportable Incident, Incident, Likely, Likely Exploitable Vulnerability (LEV), Partially Mitigated Vulnerability, Potential Agency Impact, Vulnerability

Class A

Providers with Class A Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.

Class B

Providers with Class B Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.

Class C

Providers with Class C Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.

Class D

Providers with Class D Certifications SHOULD treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.

Defined terms: FedRAMP Reportable Incident, Incident, Likely, Likely Exploitable Vulnerability (LEV), Partially Mitigated Vulnerability, Potential Agency Impact, Vulnerability