Stay FedRAMP Authorized with Qualys Policy Audit | Qualys
Summary: CISA issued Binding Operational Directive 26-04 on June 10, 2026, moving federal vulnerability expectations toward continuous, risk-based validation instead of a single fixed deadline for every finding. FedRAMP responded within days, stating that legacy monthly scanning used by most Rev5 Cloud Service Providers is insufficient, and set December 7, 2026, as the date its new Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules become mandatory for certification.
What's compelling: The monthly scan most Rev5 providers still rely on for compliance evidence will not satisfy FedRAMP after December 7, 2026, and Qualys cites its own analysis of more than 1 billion misconfiguration findings showing access control failures at 38% of exposures with an average of 14 months to fix them.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026