Reference List of Applicable Rules¶
Include a response for every rule below in your Mini-SDR. Use the force for your offering's framework and class; explain when a rule does not apply. Put any required Corrective Action Plan in that rule's response.
These tables use rules version 2026.11.02.01 and cover the report's Rev5 Class B/C/D and 20x Class B/C profiles. Class-specific rules remain included even when their force is the same across these classes. Consult the linked rules for their full statements and applicability.
This list is supplied for reference only!
In the event of a conflict between this list and the actual Consolidated Rules for 2026, always follow the official rules.
VDR Rules¶
| ID | Name | FORCE | What to provide |
|---|---|---|---|
| VDR-CSO-DET | Vulnerability Detection | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VDR-CSO-RES | Vulnerability Response | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VDR-CSO-FAV | Failures Are Vulnerabilities | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VDR-CSO-DFR | Design For Resilience | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-CSO-ADT | Automate Detection | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-CSO-DAC | Detect After Changes | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-CSO-MSP | Maintain Security | SHOULD NOT | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-CSO-AKE | Avoid KEVs | SHOULD NOT | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-CSO-SIR | Sampling | MAY | Describe implementation if applicable. |
| VDR-TFR-NMV | Non-Machine Verification and Validation | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VDR-TFR-PDD | Persistent Drift Detection | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-TFR-PCD | Persistently Complete Detection | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-TFR-PVR | Mitigation and Remediation Expectations | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-TFR-RMN | Remaining Vulnerabilities | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-TFR-KEV | Remediate KEVs | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-TFR-PSD | Persistent Sample Detection | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VDR-TFR-MVX | Persistent Machine Verification and Validation for 20x (20x only) | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VDR-TFR-MVF | Persistent Machine Verification and Validation for Rev5 (Rev5 only) | Rev5 Class B: SHOULD Rev5 Class C/D: MUST |
Class B: Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. Class C/D: Describe implementation; supply a Corrective Action Plan if not fully implemented. |
VER Rules¶
| ID | Name | FORCE | What to provide |
|---|---|---|---|
| VER-EVA-ELX | Evaluate Exploitability | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VER-EVA-EIR | Evaluate Internet-Reachability | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VER-EVA-EPA | Estimate Potential Agency Impact | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VER-EVA-AIA | Assume It's Automatable | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VER-EVA-GRV | Group Vulnerabilities | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VER-EVA-EFP | Evaluate False Positives | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VER-EVA-EFA | Evaluation Factors | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VER-RPT-PER | Persistent Reporting | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. Separately, supply a sample / example. |
| VER-RPT-VDT | Vulnerability Details | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VER-RPT-AVI | Accepted Vulnerability Info | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VER-RPT-NID | Responsible Disclosure | MUST NOT | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VER-RPT-HLO | High-Level Overviews | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VER-RPT-RPD | Responsible Public Disclosure | MAY | Describe implementation if applicable. |
| VER-TFR-MHR | Monthly Activity Report | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. Separately, supply a sample / example. |
| VER-TFR-MAV | Mark Accepted Vulnerabilities | MUST | Describe implementation; supply a Corrective Action Plan if not fully implemented. |
| VER-TFR-MRH | Historical Activity | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VER-TFR-EVU | Evaluate Vulnerabilities Quickly | SHOULD | Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VER-TFR-IRI | Internet-Reachable Incidents | Class B: MAY Class C/D: SHOULD |
Class B: Describe implementation if applicable. Class C/D: Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |
| VER-TFR-NRI | Non-Internet-Reachable Incidents | Class B/C: MAY Class D: SHOULD |
Class B/C: Describe implementation if applicable. Class D: Describe implementation; supply an explanation, resulting risk, and risk compensation options if not fully implemented. |