2026/providers/20x/rules/vulnerability-detection-and-response/

[giscus[bot]]

2026/providers/20x/rules/vulnerability-detection-and-response/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/

[ExtremoPenguin]

Can the description for VDR-TFR-PVR be updated to include the acronyms used in the table and a link to the PAIN scale?

[nicole-gov]

Reasonable request. We'll add it to the list!

[PrincetonBrooke]

Is there updated guidance or a reference on sampling? It seems VDR-CSO-SIR could violate VDR-CSO-MSP depending on how sampling is executed. ie. maintaining security of samples

[emu-gov]

No specific reference on sampling, but in terms of Force of the Rule — a SHOULD NOT for VDR-CSO-MSP is weighed higher than a MAY for VDR-CSO-SIR so if you believe sampling in your environment for a particular set of resources would weaken your architecture, then don't sample.

The rules are built to enable decision making by provider security practitioners who know their own infrastructure much better than we do.