Government cloud service providers are scrambling to adopt new cyber vulnerability management practices mandated in response to how artificial intelligence is helping hackers accelerate attacks on unpatched software bugs.
The General Services Administration’s centralized cloud security program, FedRAMP, is requiring certified cloud services to take steps to comply with new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules by early December.
The rules align with the Cybersecurity and Infrastructure Security Agency’s July binding operational directive on “prioritizing security updates based on risk.”
FedRAMP is directing all certified cloud services to migrate to the new rules by Dec. 7, but will allow vendors to submit corrective action plans for any requirement they can’t meet by that date. The program is giving vendors a three-month “grace period” through March 7, 2027, to meet the requirements.
On March 8 of next year, however, any cloud service that has not fully migrated to the new rules or isn’t working under an approved corrective action plan “will have its FedRAMP Certification revoked and be banned from FedRAMP for one year,” program officials warned in a Nov. 10 notice.
They wrote the “primary concern of the U.S. government is that cloud service providers with an active FedRAMP certification migrate to the vulnerability management and reporting approach . . . swiftly, safely, and appropriately.” The program “will not take unnecessary administrative action against” against certified cloud services that work “safely and in good faith” to adopt the new vulnerability management rules, officials added.
The new cloud security requirements mark another major cyber policy shift in response to advanced AI models.
CISA developed its BOD in reaction to the quickly evolving cyber capabilities of models like Anthropic’s Claud Mythos. The July directive requires agencies to prioritize the patching of vulnerabilities that pose a higher risk to their operations and networks, while deferring lower risk bugs, rather than relying solely on uniform patch deadlines.
Likewise, FedRAMP’s new vulnerability management rules require authorized cloud vendors to shift from a “legacy vulnerability scanning to an exposure and threat-based approach.” The rules require cloud service providers to evaluate factors like whether a vulnerability is “likely reachable” over the internet and the extent to which it is exploitable.
“The urgency of the threat that made this aggressive deadline necessary five months ago has only increased since then, with the recent Black October hammering this threat home across the global infosec community,” FedRAMP officials wrote in the Nov. 10 notice, referring to last month’s spate of AI-driven security incidents and vulnerability disclosures.
The new rules will require more than 550 FedRAMP certified providers to adopt a more proactive and tailored vulnerability management approach compared to legacy rules that relied on monthly scans and vulnerability severity scores.
“It’s just such a drastic change from the way that they were doing it before,” Matt Bruggeman, director of GTM Federal at A-LIGN, told Federal News Network.
For vendors that have built their government-specific cloud offerings in line with traditional vulnerability, the new rules may pose a broader engineering challenge than just upgrading to new security tools.
“It’s been a pretty big uplift,” Bruggeman said. “A lot of them are looking to third-party tooling to help with that process, and a lot of them already were using some sort of tooling for vulnerability scans and things like that, but a lot of those providers aren’t able to meet these new requirements, so they’re having to look for new providers, and so it has been a decent amount of uplift and work.”
In early December, FedRAMP plans to initiate a quarterly “security inbox emergency test” to collect progress reports from cloud providers on their adoption of the new vulnerability management processes.
The program will put any cloud service offering that fails to respond to the test into remediation status on the FedRAMP marketplace for at least 30 days. Vendors that don’t respond to the initial test and then fail to respond with a follow-up corrective action plan will have their certification revoked.
The vulnerability management policy is a major shift, but it may offer just a preview of how the cloud security program is evolving in response to AI and other threats.
“Cloud service providers must have sufficient budget, planning, and engineering capability for the continuous operational improvements necessary to keep responding to this accelerating threat,” FedRAMP officials wrote in the Nov. 10 notice. “They must also be able to assure federal government customers that they are doing so by meeting changing expectations for automated assurance over the coming years. The mandatory migration to the VDR/VER rules is only the first of many migrations that cloud service providers will need to make over the coming years; yearly paperwork exercises are no longer appropriate or sufficient in this era of continuously evolving threats.”
FedRAMP Director Pete Waterman made similar comments earlier this year in the wake of Hugging Face hack by OpenAI agents, saying that vendors who only equate FedRAMP with compliance are “cooked.”
Under the FedRAMP 20X initiative, the program is shifting to more automated, real-time security monitoring processes, rather than relying on large authorization document packages.
Bruggeman said the new vulnerability management approach aligns with FedRAMP’s broader shift away from point-in-time assessments.
“I think they not only saw that this is the speed at which we need to respond to threat actors, especially in the age of AI, but it is absolutely a part of this larger philosophical shift to say, “Hey, we need a better understanding in real time of what your security is at any given point in time, and I need to be able to look at a history of that, without it being 10 months old,’” Bruggeman said.
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
