FedRAMP requires cloud security overhaul by Dec. 7, with certification at stake

Cloud providers serving federal agencies must change how they find, assess and report software weaknesses by December 7, 2026. In a November 10 notice, FedRAMP warned that services neither completing the migration nor working under an approved corrective-action plan face certification revocation and a one-year ban starting March 8, 2027, Federal News Network reported.

Which flaws can an attacker actually reach?

FedRAMP, the General Services Administration’s centralized cloud security program, is moving certified services away from legacy vulnerability scanning. Its new Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules replace an approach built around monthly scans and severity scores with one focused on exposure and threats.

Rather than rely on a discovered weakness’s severity score alone, providers must consider the conditions that could make it useful to an attacker. The rules include two concrete factors:

• Internet reachability: whether the vulnerable software is likely reachable over the internet.
• Exploitability: the extent to which the weakness can be used in an attack.

That approach aligns with the Cybersecurity and Infrastructure Security Agency’s July directive on risk-based security updates. It requires agencies to prioritize vulnerabilities posing greater risks to their operations and networks while deferring lower-risk bugs, rather than relying solely on uniform patch deadlines.

FedRAMP officials tied the urgency to an accelerating threat, citing October’s AI-driven security incidents and vulnerability disclosures in their November notice. The requirements cover more than 550 certified providers.

A tooling change can become an engineering project

Vendors may need to do more than replace or update a scanner to meet the rules. A-LIGN’s Matt Bruggeman told Federal News Network that the shift has taken substantial work. Some vendors are also looking for new tools because their current scanning suppliers cannot meet the requirements.

Officials said they would avoid unnecessary administrative action against certified services working safely and in good faith to adopt the rules.

An unanswered inbox carries its own penalty

FedRAMP plans to begin quarterly security inbox emergency tests in early December, collecting progress reports on adoption of the new vulnerability-management processes.

If a cloud offering does not respond, FedRAMP will place it in remediation status on the marketplace for at least 30 days. Certification will be revoked if a vendor misses the first test and then fails to submit a corrective-action plan after a follow-up.

Officials also warned providers to budget and engineer for continuous operational improvements and changing automated-assurance expectations. They described this mandatory migration as the first of many to come, saying yearly paperwork exercises are no longer sufficient for continuously evolving threats.