2026/providers/rev5/rules/vulnerability-detection-and-response/

[giscus[bot]]

2026/providers/rev5/rules/vulnerability-detection-and-response/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/providers/rev5/rules/vulnerability-detection-and-response/?h=vdr

[dff030826]

I have 4 questions below.

1. VDR-CSO-SIR- Sampling: What is the intent of the above requirement and is this referring to a staging environment?

2. VDR-CSO-DAC – Detect After Changes: Is the expectation that this sampling is performed only if there are new or changed resources and if there are no new or changes resources then this requirement would not be applicable? We’re trying to understand how/when this requirement would need to be met.

3. VDR-TFR-PVR - Mitigation and Remediation Expectations: Is the expectation that we no longer use severity of High, Moderate and Low and we should use the new N-ratings instead? Please let us know what is expected.

4. VDR-TFR-PSD - Persistent Sample Detection: Regarding the “samples” mentioned, is the thought that we would need to create scans to review sample data? What is the thought around achieving this process? It is assumed that this should be done to monitor vulns more often. Please clarify.

[pete-gov]

VDR-CSO-SIR- Sampling: What is the intent of the above requirement and is this referring to a staging environment?

If you have 100 things that you know are the same (such as via cryptographic integrity verification) then you may choose to just look at 1 of them and make decisions related to the 100 things based on that. This is not referring to a staging environment.

The word "sample" is used in the plain language meaning of the term, such as this definition from Merriam-Webster: "a representative part or a single item from a larger whole or group especially when presented for inspection or shown as evidence of quality"

VDR-CSO-DAC – Detect After Changes: Is the expectation that this sampling is performed only if there are new or changed resources and if there are no new or changes resources then this requirement would not be applicable? We’re trying to understand how/when this requirement would need to be met.

There is never ever an expectation that things are "only" done in specific situations - providers can and should exceed all of these requirements. This particular requirement is simply stating that if you make significant changes to resources then you should perform vulnerability detection after doing so (generally, this would be done as part of an automated deployment or change process). This requirement only triggers when a new information resource is deployed or an existing one is significantly changed.

As a rudimentary example, if you are going to replace 100 operating system containers with new ones to fix a major security flaw, once you deploy those 100 new containers you should run vulnerability detection on some of them to ensure that both the issue is fixed and new vulnerabilities were not introduced.

VDR-TFR-PVR - Mitigation and Remediation Expectations: Is the expectation that we no longer use severity of High, Moderate and Low and we should use the new N-ratings instead? Please let us know what is expected.

Yes, follow the rules.

VDR-TFR-PSD - Persistent Sample Detection: Regarding the “samples” mentioned, is the thought that we would need to create scans to review sample data? What is the thought around achieving this process? It is assumed that this should be done to monitor vulns more often. Please clarify.

Testing representative samples means that instead of testing every single thing, you pick a set of representative samples and only test those. Most modern architectures widely deploy many similar things - let's say an operating system image, if you have the same operating system installed on 50,000 things then the parts that are the same at that version (such as a standard library installed on every system) don't need to be checked on everything. You can pull a representative sample (if they're all exactly the same then 1 node might be sufficient) and perform vulnerability detection on it.

I will note that "scans" are only one minor aspect of vulnerability detection and there are many other ways to go about this. You don't even ever need to do a vulnerability scan of an operating system if you maintain a proper inventory of what is in your systems, for example.

Hope that helps! These rules are intended to ensure the focus is on meaningful security assessment during vulnerability detection instead of just running scans against everything over and over.

[walkawaze]

The verbiage for VDR-TFR-PVR needs to be updated to use Mitigate & Remediate in their proper context. the current verbiage states: "...partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below..." Remediation fixes the root cause (eliminates the vulnerability), Mitigation can reduce the risk of the vulnerability or prevent the circumstances that the vulnerability can be exploited. You do not Remediate a vulnerability to a lower risk/PAIN rating, that would be to mitigate it.

[pete-gov]

The spirit of this wording is that no PAIN is lower than PAIN 1, that should be relatively clear... but I'll take a pass at updating the language without changing the effect.