PAIN rating

FedRAMP's December 7 rules shrink the worst-case remediation window to 12 hours

FedRAMP will require daily vulnerability scans at Class D and fixes in as little as 12 hours from December 7, 2026, with a grace period to March 7, 2027. Failures in the detection pipeline now count as vulnerabilities themselves.