VDR-TFR-MVXPersistent Machine Verification and Validation for 20x
20xvaries by class: a, b, c
The statement for this requirement varies by certification class — see the per-class deadlines below.
Who it binds
Controls whose FedRAMP guidance points at VDR (12)
Their guidance names the Vulnerability Detection and Response rules as a whole, not this requirement — so this is where to read from, not a mapping to this clause. Controls no KSI reaches have no page and are not listed.
Deadlines (3)
| Class | Timeframe | Statement |
|---|---|---|
| C | 3 days | Providers of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days. |
| B | 7 days | Providers of FedRAMP 20x Class B offerings MUST verify and validate the status of machine-based information resources at least once every 7 days. |
| A | 1 month | Providers of FedRAMP 20x Class A offerings SHOULD verify and validate the status of machine-based information resources at least once every month. |
Which certifications it binds
- Certification type
- 20x · Rev5
- Path
- Program · Agency
Evidence this requirement demands
No requirement-specific artifacts — but the defaults below still apply.
5 default artifacts owed by every FRR requirement
- Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.
- Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.
- Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.
- Independent verification.
- Independent validation.
Group 20x, subset TFR of Vulnerability Detection and Response. See all obligations on /obligations or the full evidence plan on /evidence.