FedRAMP Rev 5 vulnerability scanning and supply chain controls
what cloud providers must do to keep a federal authorization
FedRAMP Baselines Rev 5 align the program to NIST SP 800-53 Rev 5. For any cloud service provider selling to a US federal agency, the day-to-day work lives in four control areas: RA-5 vulnerability scanning, the new SR (Supply Chain Risk Management) control family, CA-7 continuous monitoring, and SI-2 flaw remediation.
The headline obligation is RA-5: monthly authenticated scans of operating systems and infrastructure, web applications including APIs, and databases, with remediation service levels of 30 days for high, 90 days for moderate, and 180 days for low. Miss those windows and your continuous monitoring posture, and ultimately your authorization, is at risk. Official program guidance lives at fedramp.gov.
An authorization is not a one-time event. Rev 5 makes that explicit.
FedRAMP Rev 5 rebased the program on NIST SP 800-53 Rev 5, completing the transition across 2023 and 2024 with ongoing RFC updates. The practical change is not just renumbered controls. It shifts weight toward continuous evidence: scans you can prove ran, findings you can prove you closed inside the clock, and a supply chain you can prove you understand.
The new SR (Supply Chain Risk Management) control family is the headline addition, raising the High baseline from 17 to 18 control families. It asks cloud providers to assess software trustworthiness, manage third-party dependencies, secure their SDLC, and control who can touch code and build systems (SR family). Combined with RA-5 scanning and SI-2 remediation, it closes the loop between knowing what you ship and fixing what is wrong with it.
The remediation service levels are unforgiving and specific: 30 days for high-severity findings, 90 for moderate, 180 for low (RA-5). Continuous monitoring under CA-7 means an agency is watching whether you actually hit them. Treat RA-5, SR, CA-7 and SI-2 as a single operating rhythm rather than four separate audits.
Find it before attackers do. Catch it if they try. Fix it fast.
Across these requirements, O3 runs one continuous loop on your own software so issues surface, get caught, and get fixed before they become an incident.
Test like an AI-assisted attacker
An agentic pentest probes your app across 50+ vulnerability classes the way a real attacker chains them, so exploitable flaws surface in your build before someone outside finds them.
Detect and block exploitation at runtime
A kernel-level eBPF agent watches process trees and syscalls, recognises an attack sequence as it unfolds, and restricts the offending process on the spot rather than taking down the host.
Auto-patch what is reachable
Reachability ranks what genuinely matters, then autofix opens a pull request with the change, so remediation starts inside tight fix windows instead of sitting in a queue.
From alert flood to a short list
KEV + EPSS + reachability turn a raw scan into the few findings that actually need action now.
Illustrative funnel. Reachability removes the bulk of unexploitable noise before triage.
The clock by finding type
Indicative fix windows. Tightest where exposure and active exploitation meet.
How to run FedRAMP-compliant vulnerability scans
RA-5 is the operational core of continuous monitoring. FedRAMP expects authenticated, credentialed scans across three surfaces every month, not unauthenticated network sweeps that miss host-level issues.
O3 runs SAST with source-to-sink taint analysis, SCA against OSV, and agentic DAST across 50+ vulnerability classes, covering the web-app and API layer of RA-5. Function-level reachability ranks whether a dependency flaw is actually exploitable so the backlog reflects real risk.
How to meet the 30 / 90 / 180-day remediation deadlines
FedRAMP fixes hard remediation windows by severity. The clock starts at discovery, so the difference between passing and failing ConMon is usually process discipline, not tooling.
O3 prioritizes findings with EPSS exploit-probability and CISA KEV data, then offers autofix and auto-PR to shorten the path from discovery to a merged fix inside the 30/90/180-day windows.
How to satisfy the new SR supply chain control family
Rev 5 added the SR (Supply Chain Risk Management) family, raising the High baseline to 18 families. It pushes cloud providers to prove they understand and control what goes into their software.
O3 generates a CycloneDX SBOM enriched with deps.dev and VEX, plus CBOM, QBOM, AIBOM and HBOM, giving the component inventory SR-3/SR-4 expect. Malicious-dependency detection flags typosquats, malicious postinstall scripts and compromised maintainers, and O3 reads SLSA and cosign provenance to support authenticity checks (SR-11).
How to operate continuous monitoring under CA-7
CA-7 is the wrapper that makes RA-5 and SI-2 ongoing obligations. Agencies expect a predictable monthly ConMon package and the ability to detect drift between assessments.
O3's eBPF runtime agent builds kernel-level process trees and detects attack chains continuously, and its L7 deep packet inspection baselines egress and flags exfiltration and DNS tunneling, adding between-scan signal that supports CA-7 monitoring.
How to run flaw remediation under SI-2
SI-2 is the control behind your patching discipline. It connects identified flaws to installed fixes and ties directly into the RA-5 remediation timelines.
O3 autofix and auto-PR generate remediation changes directly, helping close flaws within SI-2 timeframes, and reachability plus EPSS/KEV ensure effort goes to flaws that are genuinely exploitable.
How to manage POA&Ms and deviation requests
Findings that cannot be closed in time do not have to break your authorization, but they must be governed transparently. The POA&M and the deviation request are the mechanisms FedRAMP gives you.
Every control that matters mapped to what you actually do
All 22 requirement areas, each with the reference and a vendor-neutral note on how teams meet it.
Turn RA-5 and SR into a measurable rhythm
FedRAMP Rev 5 rewards providers who can prove the loop runs every month: scan, prioritize, fix, and evidence. O3 covers the application and supply-chain side of that loop with SAST, SCA, reachability, agentic DAST, a CycloneDX SBOM, malicious-dependency detection, and EPSS/KEV-driven autofix, plus eBPF runtime signal between scans. See where it fits your continuous monitoring package.
Read it on fedramp.gov- Under RA-5, cloud service providers must remediate high-severity findings within 30 days, moderate within 90 days, and low within 180 days. The clock starts at the scan discovery date. Findings that cannot be closed in time must be tracked on the POA&M or addressed through a documented deviation request before the deadline.
- FedRAMP requires monthly authenticated, credentialed vulnerability scans as part of continuous monitoring. Scans must cover three layers: operating systems and infrastructure, web applications including their APIs, and databases. Coverage must span the full authorization boundary, including auto-scaled and ephemeral instances.
- SR is the Supply Chain Risk Management control family added in Rev 5, which raised the High baseline from 17 to 18 control families. It requires providers to assess software trustworthiness, manage third-party dependencies, verify component provenance and authenticity (SR-4, SR-11), and secure their SDLC with code reviews and access controls.
- CA-7 requires an ongoing monitoring program with defined metrics and reporting frequency, delivered as a monthly ConMon package: updated scan results, an inventory of changes, and a current POA&M. It is the control that turns RA-5 scanning and SI-2 remediation from point-in-time checks into continuous obligations agencies review.
- RA-5 finds the flaws through scanning; SI-2 governs fixing them. SI-2 covers identifying, reporting, testing, and installing security-relevant updates within committed timeframes. In practice the two share one backlog: an RA-5 finding becomes an SI-2 remediation action tracked against the 30/90/180-day windows.
- FedRAMP does not name a standalone SBOM mandate, but the SR family (SR-3, SR-4) effectively requires a maintained inventory of third-party and open-source components with provenance, and RA-5 needs that inventory to scope scanning. A CycloneDX SBOM is the practical way to satisfy both and to demonstrate component authenticity under SR-11.
- FedRAMP Rev 5 defines Low, Moderate, and High baselines aligned to NIST SP 800-53 Rev 5, plus a LI-SaaS tailored baseline. The High baseline includes 18 control families after SR was added. The baseline you select determines which controls, including which RA-5 and SR enhancements, apply to your system.
- Overdue findings damage your continuous monitoring posture under CA-7 and can put the authorization at risk if they accumulate or go ungoverned. The expected path is to track the item on the POA&M and, where a timely fix is not feasible, submit a deviation request (false positive, operational requirement, or risk adjustment) with evidence before the SLA expires.
See O3 Security in Action
See why security and engineering leaders trust O3
to secure their entire software supply chain.