{ "schema": "nineline.trust-public/1", "kind": "vdr-ver-status", "generatedAt": "2026-10-21T17:50:14+00:00", "rulesVersion": "2026.10.13.01", "certificationClass": "C", "effective": { "required": "2026-12-07", "graceUntil": "2027-03-07" }, "totals": { "Implemented": 0, "Partially Implemented": 0, "Not Implemented": 36, "rules": 36 }, "families": [ { "family": "VDR", "name": "Vulnerability Detection and Response", "rules": [ { "id": "VDR-CSO-ADT", "name": "Automate Detection", "force": "SHOULD", "statement": "Providers SHOULD use automated services to improve and streamline vulnerability detection and response.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-CSO-AKE", "name": "Avoid KEVs", "force": "SHOULD NOT", "statement": "Providers SHOULD NOT deploy or otherwise activate new machine-based information resources with Known Exploited Vulnerabilities.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-CSO-DAC", "name": "Detect After Changes", "force": "SHOULD", "statement": "Providers SHOULD automatically perform vulnerability detection on representative samples of new or significantly changed information resources.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-CSO-DET", "name": "Vulnerability Detection", "force": "MUST", "statement": "Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-CSO-DFR", "name": "Design For Resilience", "force": "SHOULD", "statement": "Providers SHOULD make design and architecture decisions for their cloud service offering that mitigate the risk of vulnerabilities by default AND decrease the risk and complexity of vulnerability detection and response.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-CSO-FAV", "name": "Failures Are Vulnerabilities", "force": "MUST", "statement": "Providers MUST treat problems or failures with their vulnerability detection and response processes as vulnerabilities.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-CSO-MSP", "name": "Maintain Security", "force": "SHOULD NOT", "statement": "Providers SHOULD NOT weaken the security of information resources to facilitate vulnerability scanning, detection, or assessment activities.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-CSO-RES", "name": "Vulnerability Response", "force": "MUST", "statement": "Providers MUST systematically, persistently, and promptly track, evaluate, monitor, mitigate, remediate, assess exploitation of, report, and otherwise manage all detected vulnerabilities within their cloud service offering; this process is called vulnerability response.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-CSO-SIR", "name": "Sampling", "force": "MAY", "statement": "Providers MAY sample effectively identical information resources, especially machine-based information resources, when performing vulnerability detection UNLESS doing so would decrease the efficiency or effectiveness of vulnerability detection.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-TFR-KEV", "name": "Remediate KEVs", "force": "SHOULD", "statement": "Providers SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-TFR-MVX", "name": "Persistent Machine Verification and Validation for 20x", "force": "MUST", "statement": "Providers of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days.", "details": [], "timeframeAtClassC": "3 days", "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-TFR-NMV", "name": "Non-Machine Verification and Validation", "force": "MUST", "statement": "Providers MUST verify and validate the status of non-machine-based information resources at least once every 3 months.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-TFR-PCD", "name": "Persistently Complete Detection", "force": "SHOULD", "statement": "Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.", "details": [], "timeframeAtClassC": "1 months", "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-TFR-PDD", "name": "Persistent Drift Detection", "force": "SHOULD", "statement": "Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days.", "details": [], "timeframeAtClassC": "14 days", "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-TFR-PSD", "name": "Persistent Sample Detection", "force": "SHOULD", "statement": "Providers with Class C Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days.", "details": [], "timeframeAtClassC": "3 days", "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-TFR-PVR", "name": "Mitigation and Remediation Expectations", "force": "SHOULD", "statement": "Providers with Class C Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VDR-TFR-RMN", "name": "Remaining Vulnerabilities", "force": "SHOULD", "statement": "Providers SHOULD mitigate or remediate remaining vulnerabilities during routine operations as determined necessary by the provider.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" } ] }, { "family": "VER", "name": "Vulnerability Evaluation and Reporting", "rules": [ { "id": "VER-EVA-AIA", "name": "Assume It's Automatable", "force": "MUST", "statement": "Providers MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-EVA-EFA", "name": "Evaluation Factors", "force": "SHOULD", "statement": "Providers SHOULD consider at least the following factors when considering the context of the cloud service offering to evaluate detected vulnerabilities:", "details": [ "Criticality: How important are the systems or information that might be impacted by the vulnerability?", "Reachability: How might a threat actor reach the vulnerability and how likely is that?", "Exploitability: How easy is it for a threat actor to exploit the vulnerability and how likely is that?", "Detectability: How easy is it for a threat actor to become aware of the vulnerability and how likely is that?", "Prevalence: How much of the cloud service offering is affected by the vulnerability?", "Privilege: How much privileged authority or access is granted or can be gained from exploiting the vulnerability?", "Proximate Vulnerabilities: How does this vulnerability interact with previously detected vulnerabilities, especially partially or fully mitigated vulnerabilities?", "Known Threats: How might already known threats leverage the vulnerability and how likely is that?" ], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-EVA-EFP", "name": "Evaluate False Positives", "force": "SHOULD", "statement": "Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are false positive vulnerabilities.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-EVA-EIR", "name": "Evaluate Internet-Reachability", "force": "MUST", "statement": "Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are internet-reachable vulnerabilities.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-EVA-ELX", "name": "Evaluate Exploitability", "force": "MUST", "statement": "Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are likely exploitable vulnerabilities.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-EVA-EPA", "name": "Estimate Potential Agency Impact", "force": "MUST", "statement": "Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to estimate the likely potential agency impact of exploitation on government customers AND assign one of the following Potential Agency Impact N-ratings (PAIN):", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-EVA-GRV", "name": "Group Vulnerabilities", "force": "SHOULD", "statement": "Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to identify logical groupings of affected information resources that may improve the efficiency and effectiveness of vulnerability response by consolidating further activity; FedRAMP Vulnerability Detection and Response rules are then applied to these consolidated groupings of vulnerabilities instead of each individual detected instance.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-RPT-AVI", "name": "Accepted Vulnerability Info", "force": "MUST", "statement": "Providers MUST include the following information on accepted vulnerabilities when reporting on vulnerability detection and response activity:", "details": [ "Provider's internally assigned tracking identifier", "Time and source of the detection", "Time of completed evaluation", "Is it an internet-reachable vulnerability or not?", "Is it a likely exploitable vulnerability or not?", "Currently estimated Potential Agency Impact N-rating", "Explanation of why this is an accepted vulnerability", "Any supplementary information the provider determines will responsibly help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the accepted vulnerability" ], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-RPT-HLO", "name": "High-Level Overviews", "force": "SHOULD", "statement": "Providers SHOULD include high-level overviews of ALL vulnerability detection and response activities conducted during this period for the cloud service offering; this includes vulnerability disclosure programs, bug bounty programs, penetration testing, assessments, etc.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-RPT-NID", "name": "Responsible Disclosure", "force": "MUST NOT", "statement": "Providers MUST NOT irresponsibly disclose specific sensitive information about vulnerabilities that would likely lead to exploitation, but MUST disclose sufficient information for informed risk-based decision-making to all necessary parties.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-RPT-PER", "name": "Persistent Reporting", "force": "MUST", "statement": "Providers MUST report vulnerability detection and response activity (including persistent verification and validation) to all necessary parties persistently, summarizing ALL activity since the previous report; these reports are FedRAMP Certification Data and are subject to FedRAMP Certification Data Sharing rules.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-RPT-RPD", "name": "Responsible Public Disclosure", "force": "MAY", "statement": "Providers MAY responsibly disclose vulnerabilities publicly or with other parties if the provider determines doing so will NOT likely lead to exploitation.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-RPT-VDT", "name": "Vulnerability Details", "force": "MUST", "statement": "Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability:", "details": [ "Provider's internally assigned tracking identifier", "Time and source of the detection", "Time of completed evaluation", "Is it an internet-reachable vulnerability or not?", "Is it a likely exploitable vulnerability or not?", "Historically and currently estimated Potential Agency Impact N-rating of exploitation", "Time and Potential Agency Impact N-rating of each completed and evaluated reduction in Potential Agency Impact N-rating", "Estimated time and target Potential Agency Impact N-rating of next reduction in Potential Agency Impact N-rating", "Is it currently or is it likely to become an overdue vulnerability or not? If so, explain.", "Any supplementary information the provider responsibly determines will help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the vulnerability", "Final disposition of the vulnerability" ], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-TFR-EVU", "name": "Evaluate Vulnerabilities Quickly", "force": "SHOULD", "statement": "Providers with Class C Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 5 days of detection.", "details": [], "timeframeAtClassC": "5 days", "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-TFR-IRI", "name": "Internet-Reachable Incidents", "force": "SHOULD", "statement": "Providers with Class C Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-TFR-MAV", "name": "Mark Accepted Vulnerabilities", "force": "MUST", "statement": "Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-TFR-MHR", "name": "Monthly Activity Report", "force": "MUST", "statement": "Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-TFR-MRH", "name": "Historical Activity", "force": "SHOULD", "statement": "Providers with Class C Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 14 days.", "details": [], "timeframeAtClassC": "14 days", "affects": [ "Providers" ], "status": "Not Implemented" }, { "id": "VER-TFR-NRI", "name": "Non-Internet-Reachable Incidents", "force": "MAY", "statement": "Providers with Class C Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.", "details": [], "timeframeAtClassC": null, "affects": [ "Providers" ], "status": "Not Implemented" } ] } ] }