Rev. 5 Providers Have Until December to Change How They Manage Vulnerabilities

FedRAMP Rev. 5 providers who thought FedRAMP 20x was a future problem just received a very clear update: parts of the 20x operating model are becoming mandatory this year. In this episode, Ingrid Velasquez-Woodley speaks with Sam Leestma, VP of Solutions Engineering, and Spence Whitten, Principal Consultant at 38North Security, about three major updates: CISA Binding Operational Directive 26-04 FedRAMP Notice 0014 FedRAMP Notice 0013 Together, these updates change how vulnerabilities are prioritized, evaluated, mitigated, remediated, and reported—and make clear that Rev. 5 is already moving toward the automation and continuous-assurance model behind FedRAMP 20x. Topics include: Why vulnerability ratings and standard SLAs do not tell teams what to fix first. How exposure, known exploitation, automation, and technical impact affect prioritization Why FedRAMP says monthly vulnerability scanning is insufficient The difference between Vulnerability Detection and Response and Vulnerability Evaluation and Reporting Publicly exposed assets versus internet-reachable components Why mitigation and remediation are not the same thing What the new Security Decision Record changes How Notice 0013 affects the future of Rev. 5 What providers should do before the December 7, 2026 deadline How cloud providers should think about choosing Rev. 5 or FedRAMP 20x The immediate priority for existing Rev. 5 providers is VDR and VER readiness. But the broader message is just as important: Providers need to prepare for a FedRAMP model built around modern architecture, automation, risk-based decisions, and continuous reporting. Learn more about FedRAMP 20x , CR26, and VDR/VER readiness at: https://38northsecurity.com/get-fedra... Explore more FedRAMP 20x insights from 38North Security: https://38northsecurity.com/fedramp-20x/ Explore 38North Security’s FedRAMP services: https://38northsecurity.com/security-... #FedRAMP #FedRAMP20x #cloudsecurity #cybersecurity #govtech #38NorthSecurity #federal #cloudsecuritypodcast