2026/reference/vulnerability-detection-and-response/

[giscus[bot]]

2026/reference/vulnerability-detection-and-response/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/reference/vulnerability-detection-and-response/?h=vdr

[jadams360]

None of the tables include PAIN-1 and PAIN-0. Does PAIN-1 and PAIN-0 fall entirely under VDR-TFR-RMN (“routine operations as determined necessary by the provider”), with no outer bound?

[pete-gov]

That's correct!