# VER-TFR-MRH — Historical Activity

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /requirement/ver-tfr-mrh

Vulnerability Evaluation and Reporting (`VER`) · group all · subset TFR
Force: none stated

## Statement

_No statement text is recorded for this requirement._

## Who it binds

- Providers

## Certification classes

- class A
- class B
- class C
- class D

## Which certifications it binds

Certification type: 20x, Rev5
Path: Program, Agency

## Machine-readable form

FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH) — https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json

## Artifacts

- {"text":"URL and access instructions for historical vulnerability detection and response activity in machine readable format","scope":"all","class":"a","source":"requirement"}
- {"text":"URL and access instructions for historical vulnerability detection and response activity in machine readable format","scope":"all","class":"b","source":"requirement"}
- {"text":"or an explanation of why machine readable content is not being provided","scope":"all","class":"b","source":"requirement"}
- {"text":"URL and access instructions for historical vulnerability detection and response activity in machine readable format","scope":"all","class":"c","source":"requirement"}
- {"text":"or an explanation of why machine readable content is not being provided","scope":"all","class":"c","source":"requirement"}
- {"text":"URL and access instructions for historical vulnerability detection and response activity in machine readable format","scope":"all","class":"d","source":"requirement"}
- {"text":"or an explanation of why machine readable content is not being provided","scope":"all","class":"d","source":"requirement"}

## Timeframes

- {"requirementId":"VER-TFR-MRH","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Historical Activity","statement":"Providers with Class D Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 7 days.","force":"SHOULD","affects":["Providers"],"class":"d","num":7,"type":"days","sortKey":168}
- {"requirementId":"VER-TFR-MRH","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Historical Activity","statement":"Providers with Class C Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 14 days.","force":"SHOULD","affects":["Providers"],"class":"c","num":14,"type":"days","sortKey":336}
- {"requirementId":"VER-TFR-MRH","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Historical Activity","statement":"Providers with Class A Certifications MAY make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information MAY be updated persistently, at least once every month.","force":"MAY","affects":["Providers"],"class":"a","num":1,"type":"months","sortKey":730.5}
- {"requirementId":"VER-TFR-MRH","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Historical Activity","statement":"Providers with Class B Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every month.","force":"SHOULD","affects":["Providers"],"class":"b","num":1,"type":"months","sortKey":730.5}

## Notifications

_This requirement demands no notification._