# CISA Sets FedRAMP Assessment Requirements

CISA’s BOD 26-04 and related FedRAMP requirements move authorized cloud service providers from reliance on monthly vulnerability scans toward continuous, risk-based assessment and evidence. The new VDR and VER rules become mandatory for certification of FedRAMP Moderate and High providers on **December 7, 2026 (33 days from now)**. The signal promotes Qualys Policy Audit as a tool, but identifies no government solicitation or contract award.

- FedRAMP Moderate and High providers should assess their readiness to produce the continuous assessment evidence required by the new rules before the December 7 certification date.
- Procurement teams evaluating or overseeing cloud services can account for the shift in vulnerability assessment and evidence practices when assessing provider readiness and authorization status.
- Qualys Policy Audit is a commercial tool promoted for this work; the requirements do not mandate that product or identify a procurement vehicle.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 03, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- Federal Risk and Authorization Management Program (FedRAMP)

### Vendors
- Qualys (Promotes Policy Audit as a tool for FedRAMP readiness)

### Sources
- [Stay FedRAMP Authorized with Qualys Policy Audit | Qualys](https://blog.qualys.com/product-tech/2026/11/03/fedramp-authorization-is-the-easy-part-how-to-stay-authorized-with-qualys-policy-audit) - Qualys