Summary

If you hold a FedRAMP certification, the nearest deadline on your calendar is December 7, 2026. FedRAMP's notice responding to CISA's BOD 26-04 puts it plainly: "The Vulnerability Detection and Response rules will be mandatory for all cloud service offerings obtaining or maintaining FedRAMP Certification effective December 7, 2026," with a grace period through March 7, 2027 for offerings operating under a corrective action plan. It is also the deadline most programs have not fully scoped. The problem is not the date.

AI summaries can be wrong sometimes—always verify important details using the source article.