FedRAMP Sets Dec. 7 Deadline for AI-Driven Vulnerability Rules

FedRAMP will strip certification from any cloud service that misses the Dec. 7 migration deadline for new vulnerability rules, and will ban that provider from the program for a full year. The General Services Administration's cloud security program set those terms in a Nov. 10 notice. More than 550 certified providers now face a compressed rewrite of how they find, rank and patch software flaws.

The mandate responds to a specific pressure: AI models are accelerating attacks on unpatched bugs, and uniform patch deadlines no longer hold.

What exactly must vendors do by Dec. 7?

All FedRAMP-certified cloud services must migrate to new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements. The rules align with the Cybersecurity and Infrastructure Security Agency's July binding operational directive on prioritizing security updates based on risk.

There is a safety valve, and it matters. Vendors that cannot meet a requirement by Dec. 7 may submit corrective action plans. The program allows a grace period through March 7, 2027.

The hard edge comes one day after that window closes. On March 8 of next year, any cloud service that has not fully migrated or is not working under an approved corrective action plan "will have its FedRAMP Certification revoked and be banned from FedRAMP for one year," program officials warned.

Officials also pledged restraint toward cooperative vendors. The government's primary concern, they wrote, is that providers migrate "swiftly, safely, and appropriately." The program "will not take unnecessary administrative action against" services working "safely and in good faith" on adoption.

Why the rush?

CISA built its July directive in reaction to the fast-evolving offensive capabilities of advanced AI models, including Anthropic's Claud Mythos. The directive requires agencies to patch high-risk vulnerabilities first and defer lower-risk bugs, replacing one-size-fits-all patch deadlines.

FedRAMP's rules follow the same logic. Certified vendors must shift from "legacy vulnerability scanning to an exposure and threat-based approach." Providers must now assess whether a vulnerability is "likely reachable" over the internet and how exploitable it actually is.

The urgency has grown, not faded. "The urgency of the threat that made this aggressive deadline necessary five months ago has only increased since then, with the recent Black October hammering this threat home across the global infosec community," FedRAMP officials wrote, referring to last month's spate of AI-driven security incidents and vulnerability disclosures.

The rules replace a legacy regime built on monthly scans and vulnerability severity scores. For context, that cadence gave attackers weeks of runway between scan cycles; the new model demands continuous, risk-ranked evaluation.

How heavy is the engineering lift?

Early evidence suggests it exceeds a tooling swap. "It's just such a drastic change from the way that they were doing it before," Matt Bruggeman, director of GTM Federal at A-LIGN, told Federal News Network.

"It's been a pretty big uplift," Bruggeman said. "A lot of them are looking to third-party tooling to help with that process, and a lot of them already were using some sort of tooling for vulnerability scans and things like that, but a lot of those providers aren't able to meet these new requirements, so they're having to look for new providers, and so it has been a decent amount of uplift and work."

That quote carries a procurement implication: incumbent vulnerability scan vendors may lose FedRAMP customer accounts if their tools cannot support reachability and exploitability analysis.

What happens if a vendor ignores the check-in?

In early December, FedRAMP will launch a quarterly "security inbox emergency test" to collect progress reports on adoption. Non-response carries graduated penalties:

• Any cloud offering that fails to respond goes into remediation status on the FedRAMP marketplace for at least 30 days.
• Vendors that miss the initial test and then fail to submit a follow-up corrective action plan lose certification entirely.

Is this a one-time migration?

No, and FedRAMP says so plainly. "The mandatory migration to the VDR/VER rules is only the first of many migrations that cloud service providers will need to make over the coming years; yearly paperwork exercises are no longer appropriate or sufficient in this era of continuously evolving threats," officials wrote.

The notice also demanded sustained investment: providers "must have sufficient budget, planning, and engineering capability" for continuous operational improvements, and must meet "changing expectations for automated assurance over the coming years."

Bruggeman framed the rules as part of a broader philosophical shift away from point-in-time assessments. Real-time visibility matters now, he argued: "I need to be able to look at a history of that, without it being 10 months old," he said of providers' security posture data.

For federal cloud buyers, the practical takeaway is a marketplace in flux. Between December's emergency tests, the March revocation deadline and forced tooling replacements, FedRAMP's authorized list may look materially different within a year.