VER-RPT Reporting

Providers MUST report vulnerability detection and response activity (including persistent verification and validation) to all necessary parties persistently, summarizing ALL activity since the previous report; these reports are FedRAMP Certification Data and are subject to FedRAMP Certification Data Sharing rules.

Schema: FedRAMP Vulnerability Detail Report (VER-RPT-VDT)

NIST SP 800-53 Rev. 5 controls: SI-7(2)

Defined terms: All Necessary Parties, Certification Data, Persistently, Validation, Verification, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability:

• Provider's internally assigned tracking identifier
• Time and source of the detection
• Time of completed evaluation
• Is it an internet-reachable vulnerability or not?
• Is it a likely exploitable vulnerability or not?
• Historically and currently estimated Potential Agency Impact N-rating of exploitation
• Time and Potential Agency Impact N-rating of each completed and evaluated reduction in Potential Agency Impact N-rating
• Estimated time and target Potential Agency Impact N-rating of next reduction in Potential Agency Impact N-rating
• Is it currently or is it likely to become an overdue vulnerability or not? If so, explain.
• Any supplementary information the provider responsibly determines will help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the vulnerability
• Final disposition of the vulnerability

Artifacts

• A recent vulnerability report or a sample vulnerability report

Schema: FedRAMP Vulnerability Detail Report (VER-RPT-VDT)

NIST SP 800-53 Rev. 5 controls: SI-2(3)

Defined terms: Accepted Vulnerability, Cloud Service Offering, Federal Customer Data, Internet-Reachable Vulnerability (IRV), Likely, Likely Exploitable Vulnerability (LEV), Overdue Vulnerability, Potential Agency Impact, Responsibly, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers MUST include the following information on accepted vulnerabilities when reporting on vulnerability detection and response activity:

• Provider's internally assigned tracking identifier
• Time and source of the detection
• Time of completed evaluation
• Is it an internet-reachable vulnerability or not?
• Is it a likely exploitable vulnerability or not?
• Currently estimated Potential Agency Impact N-rating
• Explanation of why this is an accepted vulnerability
• Any supplementary information the provider determines will responsibly help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the accepted vulnerability

Artifacts

• A recent vulnerability report or a sample vulnerability report

Schema: FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)

Defined terms: Accepted Vulnerability, Cloud Service Offering, Federal Customer Data, Internet-Reachable Vulnerability (IRV), Likely, Likely Exploitable Vulnerability (LEV), Potential Agency Impact, Responsibly, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers MUST NOT irresponsibly disclose specific sensitive information about vulnerabilities that would likely lead to exploitation, but MUST disclose sufficient information for informed risk-based decision-making to all necessary parties.

Note

This requirement will be superseded in the event of formal action related to an investigation or corrective action plan.

Defined terms: All Necessary Parties, Likely, Vulnerability

Providers SHOULD include high-level overviews of ALL vulnerability detection and response activities conducted during this period for the cloud service offering; this includes vulnerability disclosure programs, bug bounty programs, penetration testing, assessments, etc.

Defined terms: Cloud Service Offering, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers MAY responsibly disclose vulnerabilities publicly or with other parties if the provider determines doing so will NOT likely lead to exploitation.

Defined terms: Likely, Responsibly, Vulnerability