# VER-TFR-EVU — Evaluate Vulnerabilities Quickly

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /requirement/ver-tfr-evu

Vulnerability Evaluation and Reporting (`VER`) · group all · subset TFR
Force: none stated

## Statement

_No statement text is recorded for this requirement._

## Who it binds

- Providers

## Certification classes

- class A
- class B
- class C
- class D

## Which certifications it binds

Certification type: 20x, Rev5
Path: Program, Agency

## Machine-readable form

_This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._

## Artifacts

_No requirement-specific artifact is named._

## Timeframes

- {"requirementId":"VER-TFR-EVU","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","statement":"Providers with Class D Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 2 days of detection.","force":"SHOULD","affects":["Providers"],"class":"d","num":2,"type":"days","sortKey":48}
- {"requirementId":"VER-TFR-EVU","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","statement":"Providers with Class C Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 5 days of detection.","force":"SHOULD","affects":["Providers"],"class":"c","num":5,"type":"days","sortKey":120}
- {"requirementId":"VER-TFR-EVU","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","statement":"Providers with Class B Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 7 days of detection.","force":"SHOULD","affects":["Providers"],"class":"b","num":7,"type":"days","sortKey":168}
- {"requirementId":"VER-TFR-EVU","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","statement":"Providers with Class A Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 14 days of detection.","force":"SHOULD","affects":["Providers"],"class":"a","num":14,"type":"days","sortKey":336}

## Notifications

_This requirement demands no notification._