FedRAMP is requiring more than 550 certified cloud providers to adopt new vulnerability detection and reporting rules by Dec. 7, with a grace period through March 7, 2027 for those submitting corrective action plans. Providers that have not migrated or secured an approved plan by March 8, 2027 risk having certification revoked and a one-year FedRAMP ban, a shift officials link to faster AI-assisted attacks.