Vulnerability review
We review each scan with your engineers, rate what it finds and track every fix against the deadline your program sets.
Continuous monitoring after authorization
After authorization, we do the recurring work that keeps it in place. That means reviewing scans, tracking open weaknesses, writing change notices and getting ready for the annual assessment.
FedRAMP changed that work in 2026, with persistent vulnerability detection and a report every three months.
Obligations by program
| Program | Every month | Other deadlines | Every year |
|---|---|---|---|
| FedRAMP | A human-readable vulnerability report, at least monthly, from persistent detection. | An Ongoing Certification Report every three months, with a quarterly review for Classes C and D. Significant change notifications before and after transformative changes. | An independent assessment at least once a year. |
| GovRAMP | For Ready, Provisionally Authorized and Authorized: POA&Ms, the inventory, scans, deviation requests and an executive summary. Core reports quarterly. | High, moderate and low risks fixed within 30, 90 and 180 days. Notice at least 30 days before a significant change. | A 3PAO assessment of about a third of the controls, all of them every three years. |
| FISMA | What your agency’s continuous monitoring strategy sets, under NIST SP 800-137. | Under ongoing authorization, the authorizing official decides from the monitoring results. | The control assessments the strategy schedules. |
| CMMC | No monthly reporting. | POA&M items closed within 180 days of a Conditional status. | An affirmation of continued compliance in SPRS, and a new Level 2 assessment every three years. |
Sources: FedRAMP’s vulnerability detection and response (opens in a new tab) and collaborative continuous monitoring (opens in a new tab) rules; the GovRAMP Continuous Monitoring Guide (opens in a new tab); NIST SP 800-137 (opens in a new tab); and 32 CFR 170.21 and 170.22. CMMC Phase 2 is suspended; the affirmations still apply.
How long a FedRAMP provider has to act on a vulnerability
Vulnerability detection and response becomes mandatory for every FedRAMP offering on December 7, 2026, and an offering that does not comply can keep its certification under a corrective action plan until March 7, 2027. Under FedRAMP’s 2026 rules the time to mitigate or remediate turns on four facts: the certification class, how badly exploitation would hurt agencies, whether the vulnerability can be reached from the internet, and whether it is likely to be exploited.
Mitigate or remediate within
4 days
Reachable from the internet and likely exploitable, N4, Class C.
| Rating | Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability | Not Likely Exploitable Vulnerability |
|---|---|---|---|
| N5 | 2 days | 4 days | 16 days |
| N4 | 4 days | 8 days | 64 days |
| N3 | 16 days | 32 days | 128 days |
| N2 | 48 days | 128 days | 192 days |
From FedRAMP’s FedRAMP Consolidated Rules for 2026 (opens in a new tab), version 2026.10.13.01: rules VDR-TFR-PVR and VER-EVA-EPA.
The recurring work we take over
POA&Ms and accepted vulnerabilities
We keep the POA&M current, with an owner and a date for each item. FedRAMP no longer takes POA&Ms from providers under its 2026 Consolidated Rules. Providers report accepted vulnerabilities instead, and a vulnerability not fixed within 192 days of evaluation becomes one. For a FedRAMP system we keep that list current the same way, and your agencies may still keep their own POA&Ms from what you report.
Change
Before a significant change ships, we write the notice or the request your program requires, with the security impact analysis behind it.
Reporting
We assemble and check the monthly package, or FedRAMP’s quarterly report, before it goes to your agency or the PMO.
Annual assessment
We prepare the evidence and everyone who speaks to a control, then work through the assessor’s findings with you.
FedRAMP readiness