+VER Vulnerability Evaluation and Reporting
---+VER-FRP FedRAMP Responsibilities
------+VER-FRP-ARP Additional Requirements
------+VER-FRP-ADV Sensitive Details
---+VER-AGM Agency Guidance
------+VER-AGM-RVR Review Vulnerability Reports
------+VER-AGM-MAP Maintain Agency Plans of Action and Milestones
---+VER-EVA Evaluation
------+VER-EVA-ELX Evaluate Exploitability
------+VER-EVA-EIR Evaluate Internet-Reachability
------+VER-EVA-EPA Estimate Potential Agency Impact
------+VER-EVA-AIA Assume It's Automatable
------+VER-EVA-GRV Group Vulnerabilities
------+VER-EVA-EFP Evaluate False Positives
------+VER-EVA-EFA Evaluation Factors
---+VER-RPT Reporting
------+VER-RPT-PER Persistent Reporting
------+VER-RPT-VDT Vulnerability Details
------+VER-RPT-AVI Accepted Vulnerability Info
------+VER-RPT-NID Responsible Disclosure
------+VER-RPT-HLO High-Level Overviews
------+VER-RPT-RPD Responsible Public Disclosure
---+VER-TFR Timeframes
------+VER-TFR-MHR Monthly Activity Report
------+VER-TFR-MAV Mark Accepted Vulnerabilities
------+VER-TFR-MRH Historical Activity
------+VER-TFR-EVU Evaluate Vulnerabilities Quickly
------+VER-TFR-IRI Internet-Reachable Incidents
------+VER-TFR-NRI Non-Internet-Reachable Incidents

VER Vulnerability Evaluation and Reporting

The Vulnerability Evaluation and Reporting rules require cloud service providers to determine when vulnerabilities are likely to impact federal customers and report the status of such vulnerabilities to all necessary parties.

Effective

  • Status: required
  • Current status: Mandated by CISA BOD 26-04
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-12-07
  • Required for ongoing certification from: 2026-12-07
  • Grace period ends: 2027-03-07

1. Prezentare generală

VER-FRP FedRAMP Responsibilities

These rules apply to FedRAMP when setting expectations for specific cloud service providers.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: FedRAMP
VER-AGM Agency Guidance

These rules for agencies apply to all agencies using a FedRAMP Certification.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Agencies
VER-EVA Evaluation

These rules apply to the evaluation of vulnerabilities.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers
VER-RPT Reporting

These rules apply to reporting related to vulnerability detection and response.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers
VER-TFR Timeframes

These rules apply to timeframes for vulnerability detection and response.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

Cerințe

3. Reglementări asociate

Reglementări
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.