Risk-Based Vulnerability Rules and AI Incident-Disclosure Policy

FedRAMP reportedly sets a December 7 migration deadline, a March 7 grace-period end, and potential certification revocation for providers without compliance or an approved plan; assessment details remain unclear. A White House task force proposes 12 months of regulatory flexibility for good-faith voluntary AI-incident disclosures while supporting CISA reporting rules and reauthorization. Both developments remain policy signals rather than settled operational guidance.