2026/providers/20x/rules/vulnerability-evaluation-and-reporting/

[giscus[bot]]

2026/providers/20x/rules/vulnerability-evaluation-and-reporting/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/

[soya-beep]

Two consistency suggestions on the Potential Agency Impact N-rating:

VER-RPT-AVI item 6 and VER-RPT-VDT use the phrase "Potential Agency Impact N-rating," but the Terms links point to "Potential Agency Impact" (FRD-PAI), where "Potential Agency Impact N-rating (PAIN)" appears only as an "Also:" alias. Consider making PAIN a first-class term so the reporting rules and the glossary entry use the same name.
FRD-PAI defines Potential Agency Impact conceptually but does not include the N1 to N5 scale, which is defined only in VER-EVA-EPA. A reader following the Terms link to FRD-PAI does not see the operative N1 to N5 definitions. Consider including the N1 to N5 table, or a direct link to VER-EVA-EPA, in FRD-PAI so the definition is self-contained.

Noticed while implementing a machine-readable VER-RPT-AVI producer against the published schema.

From Soya (Paramify)

[emu-gov]

Poor "PAIN" — always a bridesmaid, never a bride...I will put both suggestions on the list for consideration, thx!

[soya-beep]

VER-RPT-VDT says detected-vulnerability details are reported "UNLESS it is an accepted vulnerability," so accepted ones go to VER-RPT-AVI.

Question: if a vulnerability was accepted and is later mitigated or remediated, may (or must) it then appear in VDT for its final disposition, or does it stay only in AVI?

Asked while building machine-readable VER-RPT-VDT and VER-RPT-AVI producers.

From Soya (Paramify)

[emu-gov]

My take is if you have an accepted vulnerability, then decide to mitigate/remediate, it is no longer accepted and should pop over to the VER-RPT-VDT so you can record the final disposition and/or historical vs current change in the PAIN rating.

If after you mitigate there is residual risk you want to accept, then back to the VER-RPT-AVI it goes!

[PrincetonBrooke]

Will there be a follow-up or separate item for “internet accessible”? Or is it truly no concern? It seems like internet-accessible is a vector for supply chain attacks. I think it’s at least worth mentioning that providers should be aware that third-party component vulnerabilities do exist, and to exercise caution if machines reach out to external or internal endpoints for updates, patches, etc.

[emu-gov]

Help me out, it is a non-coffee day and maybe I am just not processing your query correctly but we have VER-EVA-EIR which is to assess internet reachability.

[PrincetonBrooke]

In this section:

“FedRAMP focuses on internet-reachable (rather than internet-accessible) to ensure that any service that might receive a payload from the internet is prioritized if that service has a vulnerability that can be triggered by processing the data in the payload.”

Sorry for any confusion lol .. I now see that VDR-CSO-DAC will cover the other type where the service itself initiates to pull the payload (such as during an update or patch). This should potentially cover supply chain vulnerabilities.

[emu-gov]

Alrighty, the fog of morning has lifted and I understand what you were saying.

Part of the focus for reachable vs accessible is there is an expectation that services are restricting and protecting their egress. Which is also why we very intentionally specify outbound traffic in KSI-CNA-RNT which is just 20x now, but we'll all be there eventually.

[jtb-p]

Is the schema defined in VER-EVA-EFA intended to replace CVSS 4.0, or coexist with it, or be reciprocal to it? Or are they orthogonal in your view?

[emu-gov]

VER-EVA-EFA is to help frame decision context when evaluating vulnerabilities in a provider's specific environment. The priority for evaluation and reporting is now exploitability, reachability, potential agency impact (expressed in an N rating) and automation. This is in alignment with CISA's BOD 26-04 which there is more explanation on in NTC-0014.

Not to say that CVSS 4.0 can't be used by the provider as their own evaluation factor, but FedRAMP no longer requires the reporting of scoring nor considers in our evaluation process for CR26.