Skip to content
FedRAMP Rules Hub
JSON — GET /api/obligations

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

VER-TFR-MRHHistorical Activity

JSON — GET /api/obligationsMD — /requirement/ver-tfr-mrh.md — this page as markdown, for pasting into an agent
allvaries by class: a, b, c, d

The statement for this requirement varies by certification class — see the per-class deadlines below.

Who it binds

Providers

Controls whose FedRAMP guidance points at VER (10)

Their guidance names the Vulnerability Evaluation and Reporting rules as a whole, not this requirement — so this is where to read from, not a mapping to this clause. Controls no KSI reaches have no page and are not listed.

CA-07CM-08RA-05RA-05 (05)RA-05 (11)SI-02SI-02 (02)SI-04 (02)SI-04 (04)SI-04 (05)

Deadlines (4)

ClassTimeframeStatement
D7 daysProviders with Class D Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 7 days.
C14 daysProviders with Class C Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 14 days.
A1 monthProviders with Class A Certifications MAY make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information MAY be updated persistently, at least once every month.
B1 monthProviders with Class B Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every month.

Which certifications it binds

Certification type
20x · Rev5
Path
Program · Agency

Machine-readable form

FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)

https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json

Evidence this requirement demands

  • URL and access instructions for historical vulnerability detection and response activity in machine readable formatclass a
  • URL and access instructions for historical vulnerability detection and response activity in machine readable formatclass b
  • or an explanation of why machine readable content is not being providedclass b
  • URL and access instructions for historical vulnerability detection and response activity in machine readable formatclass c
  • or an explanation of why machine readable content is not being providedclass c
  • URL and access instructions for historical vulnerability detection and response activity in machine readable formatclass d
  • or an explanation of why machine readable content is not being providedclass d
5 default artifacts owed by every FRR requirement
  • Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.
  • Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.
  • Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.
  • Independent verification.
  • Independent validation.

Group all, subset TFR of Vulnerability Evaluation and Reporting. See all obligations on /obligations or the full evidence plan on /evidence.