---
tags:
  - Rev5
  - Cloud Service Providers
  - Rules
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Vulnerability Detection and Response

The Vulnerability Detection and Response rules require providers to continuously identify, analyze, prioritize, mitigate, and remediate vulnerabilities and related exposures through automated systems. These rules give providers flexibility in implementation while ensuring agencies receive the information needed to support ongoing authorization decisions.

**Subsets**

- [General Provider Responsibilities](#general-provider-responsibilities)
- [Timeframes](#timeframes)

!!! info "Effective Date(s) & Overall Applicability for Rev5"
    - **Required** (Mandated by CISA BOD 26-04)
    - **Optional Adoption Allowed:** 2026-07-04
    - **Obtaining Initial Certification:** 2026-12-07
    - **Maintaining Ongoing Certification:** 2026-12-07
    - **Grace Period Ends:** 2027-03-07



---


## General Provider Responsibilities {#general-provider-responsibilities}

These rules apply to all providers with FedRAMP Certifications of any type.

<div class="subset-applicability" role="group" aria-label="Applicability">
<span class="subset-applicability__group subset-applicability__group--types"><span class="subset-applicability__label">Type:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Rev5</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--paths"><span class="subset-applicability__label">Path:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Program</span><span class="subset-applicability__tag">Agency</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">Class:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--affects"><span class="subset-applicability__label">Audience:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Providers</span></span></span>
</div>

### Vulnerability Detection

??? abstract "VDR-CSO-DET"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [MUST](../../../definitions/#must){ data-preview } systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.

    ---

    !!! danger "Vulnerability Detection and Response includes all efforts to identify weaknesses in a system and is NOT limited to traditional vulnerability scanning or testing. An out-of-date control statement in the Security Decision Record is a vulnerability that must be detected and remediated just like any other vulnerability."

    ---

    _**Notes:**_

    - _FedRAMP's vulnerability detection (and response) rules are intended to set modern expectations for maintaining the security of a cloud service. Historical FedRAMP guidance on vulnerability scanning or continuous monitoring generally focused only on CVE-type vulnerabilities while leaving other types of vulnerabilities and exposures unaddressed._
    - _Providers are encouraged to leverage their existing holistic security review, architecture review, and similar processes to meet these requirements. FedRAMP strongly discourages providers from implementing separate vulnerability detection and response processes for FedRAMP reporting that are operated by independent compliance branches unless these processes are consuming data directly from the areas of the cloud service that actively maintain it._
    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [FedRAMP Practices](../../../definitions/#fedramp-practices){ data-preview }, [Incident](../../../definitions/#incident){ data-preview }, [Information Resource](../../../definitions/#information-resource){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }, [Promptly](../../../definitions/#promptly){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Vulnerability Response

??? abstract "VDR-CSO-RES"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [MUST](../../../definitions/#must){ data-preview } systematically, persistently, and promptly track, evaluate, monitor, mitigate, remediate, assess exploitation of, report, and otherwise manage all detected vulnerabilities within their cloud service offering; this process is called vulnerability response.


    ---

    _**Notes:**_

    - _If it is not possible to fully mitigate vulnerabilities or remediate vulnerabilities, providers SHOULD instead partially mitigate vulnerabilities promptly, progressively, and persistently._
    - _FedRAMP does not use the terms "mitigation" and "remediation" interchangeably. Mitigation is the process of reducing the risk and impact of a vulnerability through partial mitigation and even full mitigation; remediation is the process of entirely eliminating the vulnerability. A fully mitigated vulnerability will still exist (with negligible risk) until it has been remediated. This separation is based on the plain language definitions of these words._
    - _Please refer to FedRAMP Definitions for strict interpretation in the FedRAMP context._
    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [Fully Mitigated Vulnerability](../../../definitions/#fully-mitigated-vulnerability){ data-preview }, [Partially Mitigated Vulnerability](../../../definitions/#partially-mitigated-vulnerability){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }, [Promptly](../../../definitions/#promptly){ data-preview }, [Remediated Vulnerability](../../../definitions/#remediated-vulnerability){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Failures Are Vulnerabilities

??? abstract "VDR-CSO-FAV"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [MUST](../../../definitions/#must){ data-preview } treat problems or failures with their vulnerability detection and response processes as vulnerabilities.


    ---
    **Terms:** [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Design For Resilience

??? abstract "VDR-CSO-DFR"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [SHOULD](../../../definitions/#should){ data-preview } make design and architecture decisions for their cloud service offering that mitigate the risk of vulnerabilities by default AND decrease the risk and complexity of vulnerability detection and response.


    ---
    **Terms:** [Cloud Service Offering](../../../definitions/#cloud-service-offering){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Automate Detection

??? abstract "VDR-CSO-ADT"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [SHOULD](../../../definitions/#should){ data-preview } use automated services to improve and streamline vulnerability detection and response.


    ---
    **Terms:** [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Detect After Changes

??? abstract "VDR-CSO-DAC"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [SHOULD](../../../definitions/#should){ data-preview } automatically perform vulnerability detection on representative samples of new or significantly changed information resources.


    ---
    **Terms:** [Information Resource](../../../definitions/#information-resource){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Maintain Security

??? abstract "VDR-CSO-MSP"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [SHOULD NOT](../../../definitions/#should-not){ data-preview } weaken the security of information resources to facilitate vulnerability scanning, detection, or assessment activities.


    ---
    **Terms:** [Information Resource](../../../definitions/#information-resource){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Avoid KEVs

??? abstract "VDR-CSO-AKE"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [SHOULD NOT](../../../definitions/#should-not){ data-preview } deploy or otherwise activate new machine-based information resources with Known Exploited Vulnerabilities.


    ---
    **Terms:** [Information Resource](../../../definitions/#information-resource){ data-preview }, [Known Exploited Vulnerability (KEV)](../../../definitions/#known-exploited-vulnerability-kev){ data-preview }, [Machine-Based (Information Resources)](../../../definitions/#machine-based-information-resources){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### Sampling

??? abstract "VDR-CSO-SIR"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [MAY](../../../definitions/#may){ data-preview } sample effectively identical information resources, especially machine-based information resources, when performing vulnerability detection UNLESS doing so would decrease the efficiency or effectiveness of vulnerability detection.


    ---
    **Terms:** [Information Resource](../../../definitions/#information-resource){ data-preview }, [Machine-Based (Information Resources)](../../../definitions/#machine-based-information-resources){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
## Timeframes {#timeframes}

These rules apply to timeframes for vulnerability detection and response.

<div class="subset-applicability" role="group" aria-label="Applicability">
<span class="subset-applicability__group subset-applicability__group--types"><span class="subset-applicability__label">Type:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Rev5</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--paths"><span class="subset-applicability__label">Path:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Program</span><span class="subset-applicability__tag">Agency</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">Class:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span><br>
<span class="subset-applicability__group subset-applicability__group--affects"><span class="subset-applicability__label">Audience:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Providers</span></span></span>
</div>

### Non-Machine Verification and Validation

??? abstract "VDR-TFR-NMV"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [MUST](../../../definitions/#must){ data-preview } verify and validate the status of non-machine-based information resources at least once every 3 months.

    **Timeframe:** 3 months


    ---
    **Terms:** [Information Resource](../../../definitions/#information-resource){ data-preview }, [Machine-Based (Information Resources)](../../../definitions/#machine-based-information-resources){ data-preview }, [Validation](../../../definitions/#validation){ data-preview }, [Verification](../../../definitions/#verification){ data-preview }
### Persistent Drift Detection

??? abstract "VDR-TFR-PDD"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    === "Class A"
        Providers with Class A Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 3 months.

        **Timeframe:** 3 months

    === "Class B"
        Providers with Class B Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on all information resources that are likely to drift, at least once every month.

        **Timeframe:** 1 month

    === "Class C"
        Providers with Class C Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days.

        **Timeframe:** 14 days

    === "Class D"
        Providers with Class D Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 7 days.

        **Timeframe:** 7 days


    ---
    **Terms:** [Drift](../../../definitions/#drift){ data-preview }, [Information Resource](../../../definitions/#information-resource){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Persistently Complete Detection

??? abstract "VDR-TFR-PCD"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    === "Class A"
        Providers with Class A Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months.

        **Timeframe:** 6 months

    === "Class B"
        Providers with Class B Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months.

        **Timeframe:** 6 months

    === "Class C"
        Providers with Class C Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.

        **Timeframe:** 1 month

    === "Class D"
        Providers with Class D Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.

        **Timeframe:** 1 month


    ---
    **Terms:** [Drift](../../../definitions/#drift){ data-preview }, [Information Resource](../../../definitions/#information-resource){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Mitigation and Remediation Expectations

??? abstract "VDR-TFR-PVR"
    **Changelog:**


    - **2026-07-01:** Added relevent terms and related controls. No change to the requirement.


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    === "Class A"
        Providers with Class A Certifications [SHOULD](../../../definitions/#should){ data-preview } partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in [VER-EVA-EPA (Estimate Potential Agency Impact)](vulnerability-evaluation-and-reporting.md#estimate-potential-agency-impact){ data-preview }, internet reachability, and likely exploitability.


        ---

        **Potential Agency Impact N-rating (PAIN) Timeframes:**

        | <abbr title="Potential Agency Impact N-rating">PAIN</abbr> Rating | <abbr title="Likely Exploitable Vulnerability (LEV) + Internet-Reachable Vulnerability (IRV)">LEV + IRV</abbr> | <abbr title="Likely Exploitable Vulnerability (LEV) + Not Internet-Reachable Vulnerability (NIRV)">LEV + NIRV</abbr> | <abbr title="Not Likely Exploitable Vulnerability (NLEV)">NLEV</abbr> |
        |--------------------------|---|---|---|
        | PAIN-5 | 4 days | 8 days | 32 days |
        | PAIN-4 | 8 days | 32 days | 64 days |
        | PAIN-3 | 32 days | 64 days | 192 days |
        | PAIN-2 | 96 days | 160 days | 192 days |

    === "Class B"
        Providers with Class B Certifications [SHOULD](../../../definitions/#should){ data-preview } partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in [VER-EVA-EPA (Estimate Potential Agency Impact)](vulnerability-evaluation-and-reporting.md#estimate-potential-agency-impact){ data-preview }, internet reachability, and likely exploitability:


        ---

        **Potential Agency Impact N-rating (PAIN) Timeframes:**

        | <abbr title="Potential Agency Impact N-rating">PAIN</abbr> Rating | <abbr title="Likely Exploitable Vulnerability (LEV) + Internet-Reachable Vulnerability (IRV)">LEV + IRV</abbr> | <abbr title="Likely Exploitable Vulnerability (LEV) + Not Internet-Reachable Vulnerability (NIRV)">LEV + NIRV</abbr> | <abbr title="Not Likely Exploitable Vulnerability (NLEV)">NLEV</abbr> |
        |--------------------------|---|---|---|
        | PAIN-5 | 4 days | 8 days | 32 days |
        | PAIN-4 | 8 days | 32 days | 64 days |
        | PAIN-3 | 32 days | 64 days | 192 days |
        | PAIN-2 | 96 days | 160 days | 192 days |

    === "Class C"
        Providers with Class C Certifications [SHOULD](../../../definitions/#should){ data-preview } partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in [VER-EVA-EPA (Estimate Potential Agency Impact)](vulnerability-evaluation-and-reporting.md#estimate-potential-agency-impact){ data-preview }, internet reachability, and likely exploitability:


        ---

        **Potential Agency Impact N-rating (PAIN) Timeframes:**

        | <abbr title="Potential Agency Impact N-rating">PAIN</abbr> Rating | <abbr title="Likely Exploitable Vulnerability (LEV) + Internet-Reachable Vulnerability (IRV)">LEV + IRV</abbr> | <abbr title="Likely Exploitable Vulnerability (LEV) + Not Internet-Reachable Vulnerability (NIRV)">LEV + NIRV</abbr> | <abbr title="Not Likely Exploitable Vulnerability (NLEV)">NLEV</abbr> |
        |--------------------------|---|---|---|
        | PAIN-5 | 2 days | 4 days | 16 days |
        | PAIN-4 | 4 days | 8 days | 64 days |
        | PAIN-3 | 16 days | 32 days | 128 days |
        | PAIN-2 | 48 days | 128 days | 192 days |

    === "Class D"
        Providers with Class D Certifications [SHOULD](../../../definitions/#should){ data-preview } partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the maximum timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in [VER-EVA-EPA (Estimate Potential Agency Impact)](vulnerability-evaluation-and-reporting.md#estimate-potential-agency-impact){ data-preview }, internet reachability, and likely exploitability:


        ---

        **Potential Agency Impact N-rating (PAIN) Timeframes:**

        | <abbr title="Potential Agency Impact N-rating">PAIN</abbr> Rating | <abbr title="Likely Exploitable Vulnerability (LEV) + Internet-Reachable Vulnerability (IRV)">LEV + IRV</abbr> | <abbr title="Likely Exploitable Vulnerability (LEV) + Not Internet-Reachable Vulnerability (NIRV)">LEV + NIRV</abbr> | <abbr title="Not Likely Exploitable Vulnerability (NLEV)">NLEV</abbr> |
        |--------------------------|---|---|---|
        | PAIN-5 | 12 hours | 1 day | 8 days |
        | PAIN-4 | 2 days | 8 days | 32 days |
        | PAIN-3 | 8 days | 16 days | 64 days |
        | PAIN-2 | 24 days | 96 days | 192 days |


    ---
    **Terms:** [Fully Mitigated Vulnerability](../../../definitions/#fully-mitigated-vulnerability){ data-preview }, [Likely](../../../definitions/#likely){ data-preview }, [Partially Mitigated Vulnerability](../../../definitions/#partially-mitigated-vulnerability){ data-preview }, [Potential Agency Impact](../../../definitions/#potential-agency-impact){ data-preview }, [Remediated Vulnerability](../../../definitions/#remediated-vulnerability){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### Remaining Vulnerabilities

??? abstract "VDR-TFR-RMN"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [SHOULD](../../../definitions/#should){ data-preview } mitigate or remediate remaining vulnerabilities during routine operations as determined necessary by the provider.


    ---
    **Terms:** [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### Remediate KEVs

??? abstract "VDR-TFR-KEV"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Providers [SHOULD](../../../definitions/#should){ data-preview } remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA.



    **Reference:** [CISA BOD 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)

    ---
    **Terms:** [Known Exploited Vulnerability (KEV)](../../../definitions/#known-exploited-vulnerability-kev){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
### Persistent Sample Detection

??? abstract "VDR-TFR-PSD"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    === "Class A"
        Providers with Class A Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 14 days.

        **Timeframe:** 14 days

    === "Class B"
        Providers with Class B Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 7 days.

        **Timeframe:** 7 days

    === "Class C"
        Providers with Class C Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days.

        **Timeframe:** 3 days

    === "Class D"
        Providers with Class D Certifications [SHOULD](../../../definitions/#should){ data-preview } persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once per day.

        **Timeframe:** 1 day


    ---
    **Terms:** [Information Resource](../../../definitions/#information-resource){ data-preview }, [Machine-Based (Information Resources)](../../../definitions/#machine-based-information-resources){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }, [Vulnerability Detection](../../../definitions/#vulnerability-detection){ data-preview }
### Persistent Machine Verification and Validation for Rev5

??? abstract "VDR-TFR-MVF"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    === "Class B"
        Providers of FedRAMP Rev5 Class B offerings [SHOULD](../../../definitions/#should){ data-preview } verify and validate the status of machine-based information resources at least once every month.

        **Timeframe:** 1 month

    === "Class C"
        Providers of FedRAMP Rev5 Class C offerings [MUST](../../../definitions/#must){ data-preview } verify and validate the status of machine-based information resources at least once every month.

        **Timeframe:** 1 month

    === "Class D"
        Providers of FedRAMP Rev5 Class D offerings [MUST](../../../definitions/#must){ data-preview } verify and validate the status of machine-based information resources at least once every month.

        **Timeframe:** 1 month


    ---
    **Terms:** [Information Resource](../../../definitions/#information-resource){ data-preview }, [Machine-Based (Information Resources)](../../../definitions/#machine-based-information-resources){ data-preview }, [Validation](../../../definitions/#validation){ data-preview }, [Verification](../../../definitions/#verification){ data-preview }