FedRAMP pushes new cyber vulnerability rules to keep pace with AI - Federal News Network
The General Services Administration’s FedRAMP program has mandated new cyber vulnerability rules for certified cloud service providers, requiring them to shift from legacy scanning to an exposure and threat-based approach by December 7.
The new rules, which align with a July directive from the Cybersecurity and Infrastructure Security Agency, require cloud service providers to prioritize patching vulnerabilities that pose a higher risk to their operations and networks, rather than relying on uniform patch deadlines.
The program is granting vendors a three-month grace period through March 7, 2027, to meet the requirements.
New rules require threat-based approach
The new vulnerability management rules require authorized cloud vendors to shift from a legacy vulnerability scanning to an exposure and threat-based approach.
They must evaluate factors like whether a vulnerability is likely reachable over the internet and the extent to which it is exploitable.
The urgency of the threat that made this aggressive deadline necessary five months ago has only increased since then, with the recent Black October hammering this threat home across the global infosec community.
Providers face engineering challenge
The new rules will require more than 550 FedRAMP certified providers to adopt a more proactive and tailored vulnerability management approach compared to legacy rules that relied on monthly scans and vulnerability severity scores.
For vendors that have built their government-specific cloud offerings in line with traditional vulnerability management, the new rules may pose a broader engineering challenge than just upgrading to new security tools.
It’s just such a drastic change from the way that they were doing it before.
A-LIGN’s Bruggeman noted that the change has been a significant uplift, with many providers looking to third-party tooling to help meet the new requirements.
Consequences for non-compliant providers
FedRAMP officials warned that any cloud service that has not fully migrated to the new rules or isn’t working under an approved corrective action plan by March 8, 2027, will have its FedRAMP Certification revoked and be banned from the program for one year.
The program stated that it will not take unnecessary administrative action against certified cloud services that work safely and in good faith to adopt the new vulnerability management rules.
Related
