One platform for every FedRAMP compliance need. Cloud service providers collect evidence and track each requirement, assessors review from the same record, and agencies review the package. FedRAMP 20x and Rev 5, one engine, with AI that drafts and answers from your own evidence and runs on Vertex AI under FedRAMP High.
Consolidated Rules v2026.07.14.01 · providers, assessors, agencies · Rev 5 and 20x
↗ +8 pts
of evaluated checks passing
rules 2026.07.14.01 · evaluated 2026-08-11 09:12Z · 2h ago rules 2026.07.14.01 · evaluated 2026-08-11 11:32Z · just now
Manage connectors
AI, inside the boundary
Every model call runs on Gemini in Google Vertex AI under its FedRAMP High authorization, so your evidence and documents never leave an authorized boundary to be read. What comes back is a draft or an answer for a person to act on. Every verdict on your posture comes from the validator engine reading collected evidence, and nothing a model writes reaches your record until someone saves it.
Zenibot answers from your posture, your registers of vulnerabilities, incidents, changes and inventory, and the requirements behind them. Ask about a control and it quotes the sections of your own SSP and policies that cover it, and says so when nothing has been indexed.
Proposed text for the entries you have not written, one at a time or queued across the whole record, grounded in your system description and context documents. Placeholders arrive in brackets where a fact is missing, drafting only ever fills empty fields, and nothing is saved until you save it.
On the Overview, ask why a requirement failed and what would move it. The answer reads the run the validator engine already produced and the connectors feeding it, names the requirement IDs, and says which evidence or connector would change the finding. It is advisory: the verdict stays the engine's.
Upload the authorization boundary diagram you already maintain and it comes back as a component graph: services, data flows and connections you can correct by hand. Switch the reading off and the Inventory page and its uploads stay exactly as they are.
Exports from Wiz, Nessus, Qualys, Amazon Inspector, Security Command Center and any SARIF tool land in the vulnerability ledger directly. A scanner report that exists only as a PDF is read into draft findings, CVEs, severity and KEV status included, for a person to confirm or discard before it counts.
For the assessor: paste the scoping memo or kickoff notes and get a proposed scope and reviewer for each item it touches, and a screenshot of a console or a control panel written up as evidence with what it shows and what it does not. Both are proposals, applied only by whoever runs the assessment.
AI is off until an admin in your organization turns it on, each surface has its own switch, and every switch change is recorded in your activity log. Turning it off stops every surface at once, server-side. Prefer your own assistant? Claude and other MCP clients can connect over a read-only key, and no model runs on our side of that connection.
Who it serves
FedRAMP involves three parties working from one body of evidence. Zenibit gives each of them their own view of the same record, so nothing is exported, re-keyed or out of date between them.
Connect your cloud accounts and tooling, and every Consolidated Rules requirement is evaluated against live evidence. Gaps show up as needs evidence, monthly reports and deadlines are tracked, and your public trust center publishes from the result.
Review the package where it lives. Findings, evidence and documents are organized by requirement, each with its collection trace, so the assessment starts from the record rather than a spreadsheet of requests.
Review the package. The provider grants console access to the same findings, evidence and documents its own team works from, organized by requirement with the collection trace behind each.
The trust center
Every Zenibit customer gets a public trust center on its own URL: live status, coverage, your secure configuration documents, and clear instructions for requesting the rest. Everything on it comes from the engine, so what a visitor reads is what your evidence actually supports. When an agency needs the full package, you grant its reviewers private access to the console: the same findings, evidence and documents your own team works from.
Certification type, path, and class, stated from your evaluated posture rather than a marketing claim.
The share of requirements verified by automation, shown as a percentage on the page.
Secure configuration guides download openly; NDA-gated material is listed with instructions to request access, never hidden.
Every page carries when it was last evaluated and the exact Consolidated Rules version it was evaluated against.
Monthly activity reports published where agencies expect them, on the cadence VER requires.
Your trust center is provisioned with your account. No servers, no static-site pipeline, no separate vendor.
New to the idea? What a trust center is, and what belongs on one.
The rules, specifically
The 2026 rules redefined vulnerability: an out-of-date control statement, drift, or an unverified control now carries the same detection and remediation obligations as a CVE. BOD 26-04 replaced scan-and-file with cadences and clocks. Zenibit tracks each against your evidence and shows exactly where you stand.
| Rule | Obligation | What Zenibit does |
|---|---|---|
| VDR-TFR-KEV | Remediate Known Exploited VulnerabilitiesBy the due dates in the CISA KEV Catalog. | Keeps KEV due dates in view beside the rest of your remediation queue. |
| VER-TFR-MHR | Report activity monthlyIn a consistent, human-readable format, to all necessary parties. | Tracks the cadence so a missed month is visible to you and your assessor at the same time. |
| VER-TFR-MAV | The 192-day clockAnything not fully mitigated or remediated within 192 days of evaluation must be categorized as accepted. | Shows the clock on every open finding so acceptance is a decision, not a default. |
| VDR-TFR-MVF | Persistent machine verificationMachine-based verification and validation, a Rev 5 obligation in its own right. | Continuous evaluation is the default posture, not a scheduled scan. |
| VDR-TFR-NMV | Verify non-machine resourcesAt least once every 3 months. | Tracks the quarterly cadence alongside the machine-based one. |
Evaluated against the live Consolidated Rules datafile · currently v2026.07.14.01
Read the rules themselves: every FRR requirement, every Key Security Indicator, and the terms they lean on.
The 2026 dates
The Vulnerability Detection & Response and Vulnerability Evaluation & Reporting rules apply to every FedRAMP certification, whether obtaining or maintaining, on Rev 5 or 20x. Zenibit tracks them on both paths, so a Rev 5 provider is covered without waiting for its 20x transition.
Providers may adopt VDR and VER early and report under the new rules.
VDR and VER become mandatory for every FedRAMP certification under CISA BOD 26-04.
The default grace window closes and the rules are enforced as written.
These three come first. Every ruleset has its own dates, and they differ for 20x and Rev 5: the full deadline table.
Rev 5 and 20x
20x and Rev 5 differ in which requirements apply, not in how evidence is evaluated. Zenibit runs one validator engine against both rule sets, so the work you do for Rev 5 today is the same work 20x will ask for.
COMPLY NOW
ARRIVE READY
Meet Rev 5 today. Move to 20x on the same evidence. Switching paths is a rule-set change in Zenibit, not a second compliance program.
Deciding between them: what actually differs. Already know your path? See which rules apply to you.