FedRAMP’s vulnerability deadlines start December 7, 2026

On December 7, 2026, FedRAMP’s Vulnerability Detection and Response rules become required, as CISA Binding Operational Directive 26-04 mandates. A provider that is not ready can work under a corrective action plan until March 7, 2027. After that, every vulnerability in a FedRAMP-certified cloud service runs on its own clock.

One deadline per vulnerability

The rules replace a fixed window per severity with a timeframe set by four facts: the certification class, the vulnerability’s Potential Agency Impact rating, whether it can be reached from the internet, and whether it is likely to be exploited. The rating runs from N0, where exploitation is “extremely unlikely to have any adverse effects on agencies,” to N5, “a debilitating customer effect on more than one agency.”

For a Class C provider, an N4 vulnerability that is reachable from the internet and likely exploitable should be mitigated or remediated within 4 days. The same vulnerability behind the internet edge gets 8 days, and one that is not likely exploitable gets 64. At Class D, an N5 vulnerability that is reachable and likely exploitable gets 12 hours. The longest timeframe is 192 days; N0 and N1 have none and are handled in routine operations. The rules say providers should meet these timeframes. You can look up any combination in our vulnerability timeframe finder.

The clock starts at evaluation

Each timeframe runs from the provider’s evaluation of the vulnerability, and the rules time that too: providers should evaluate within 14 days of detection at Class A, 7 at Class B, 5 at Class C and 2 at Class D. Providers must decide whether each vulnerability is likely exploitable and internet-reachable, rate its potential agency impact, and “assume the exploitation of vulnerabilities can be automated” unless they have evidence otherwise.

Detection, reporting and accepted vulnerabilities

• Detection. Resources likely to drift should be scanned at least every 3 months at Class A, every month at Class B, every 14 days at Class C and every 7 days at Class D. Representative samples of similar machine-based resources: every 14, 7, 3 and 1 days. Resources not likely to drift: every 6 months at Classes A and B, every month at C and D.
• Reporting. Providers must report vulnerability detection and response activity to everyone who needs it, in a consistent, human-readable format, at least monthly.
• Accepted vulnerabilities. Any vulnerability that is not, or will not be, fully mitigated or remediated within 192 days of evaluation must be categorized as an accepted vulnerability.
• Known exploited vulnerabilities keep the due dates in CISA’s catalog, even once they are mitigated.
• Incidents. At Classes C and D, an internet-reachable, likely exploitable vulnerability rated above N3 should be treated as a FedRAMP reportable incident until it is partially mitigated to N3 or below.

What to set up before December 7

1. Record the four facts with every finding. Your scanner gives you severity; reachability, exploitability and the N-rating come from someone who knows the service.
2. Make evaluation a tracked step with its own due date, since every other deadline counts from it.
3. Set the scan schedule to your class, separately for resources that drift, resources that don’t and representative samples.
4. Build the monthly human-readable report once, so it is the same format every month.
5. Watch the 192-day mark. A vulnerability you cannot close in time becomes an accepted vulnerability, and reporting on it is required.

How we can help

Our continuous monitoring service runs this cycle with your team: evaluating findings, tracking each clock, and writing the monthly report. The details are on our continuous monitoring page.

Sources

All checked October 18, 2026.

• FedRAMP, Vulnerability Detection and Response: the effective dates and the mandate by CISA BOD 26-04.
• FedRAMP, Consolidated Rules for 2026, version 2026.10.13.01, the machine-readable rules: VDR-TFR-PVR (timeframes), VDR-TFR-PDD, PCD and PSD (detection), VDR-TFR-KEV, VER-EVA-EPA (impact ratings), VER-EVA-AIA, VER-TFR-EVU (evaluation), VER-TFR-MHR (monthly report), VER-TFR-MAV (accepted vulnerabilities) and VER-TFR-IRI (incidents).
• CISA, BOD 26-04: the directive the rules cite.