{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json","$schemaVersion":"0.3.0","title":"FedRAMP Common Definitions","description":"Shared type definitions referenced by other FedRAMP schemas.","$defs":{"certificationPackageOverviewUri":{"type":"string","format":"uri","title":"Certification Package Overview","description":"Full URI of the provider's Certification Package Overview document."},"logoUri":{"type":"string","format":"uri","title":"Logo","description":"URL of an organization logo. Must point to a PNG, JPEG, GIF, SVG, WebP, ICO, BMP, or TIFF file.","pattern":"\\.(png|jpe?g|gif|svg|webp|ico|bmp|tiff?)([?#].*)?$"},"nRating":{"type":"integer","title":"Potential Agency Impact N-Rating","description":"See VER-EVA-EPA or IEC-CSO-EFI for N1–N5 definitions.","enum":[1,2,3,4,5]},"detection":{"type":"object","title":"Detection","description":"Required information for a single detected vulnerability per VER-RPT-VDT.","required":["detectedAt","detectionSource"],"properties":{"detectedAt":{"type":"string","format":"date-time","title":"Detected At","description":"When the vulnerability was detected."},"detectionSource":{"type":"string","title":"Detection Source","description":"Tool or activity that identified the vulnerability (e.g., scanner, penetration test, bug bounty)."}}},"painReductionEvent":{"type":"object","title":"PAIN Reduction Event","description":"Required information for a single PAIN reduction event per VER-RPT-VDT.","required":["reducedAt","rating"],"properties":{"reducedAt":{"type":"string","format":"date-time","title":"Reduced At","description":"When the PAIN reduction was completed."},"rating":{"$ref":"#/$defs/nRating","title":"Rating After Reduction","description":"N-rating after the PAIN reduction."}}},"vulnerabilityDetail":{"type":"object","title":"Vulnerability Detail","description":"Required information for a single detected vulnerability per VER-RPT-VDT.","required":["providerTrackingId","detection","vulnerabilityDescription"],"properties":{"providerTrackingId":{"type":"string","title":"Provider Tracking ID","description":"Provider's internally assigned identifier for this vulnerability."},"detection":{"$ref":"#/$defs/detection"},"vulnerabilityDescription":{"type":"string","title":"Vulnerability Description","description":"Description of the vulnerability."},"potentialAgencyImpact":{"type":"string","title":"Potential Agency Impact","description":"Description of the potential impact."},"evaluationCompletedAt":{"type":"string","format":"date-time","title":"Evaluation Completed At","description":"When evaluation was completed. The clock for VER-TFR-MAV runs from this date."},"isInternetReachable":{"type":"boolean","title":"Is Internet-Reachable","description":"IRV classification per VER-EVA-EIR."},"isLikelyExploitable":{"type":"boolean","title":"Is Likely Exploitable","description":"LEV classification per VER-EVA-ELX and VER-EVA-AIA."},"currentRating":{"$ref":"#/$defs/nRating","title":"Current Rating","description":"Currently estimated Potential Agency Impact N-rating."},"projectedNextReduction":{"type":"object","title":"Projected Next Reduction","description":"Next planned mitigation step. Omit if fully mitigated or none planned.","required":["estimatedAt","targetRating"],"properties":{"estimatedAt":{"type":"string","format":"date-time","title":"Estimated At","description":"When the next reduction is expected."},"targetRating":{"$ref":"#/$defs/nRating","title":"Target Rating","description":"Next Potential Agency Impact N-rating."}}},"overdueStatus":{"type":"object","title":"Overdue Status","description":"See VER-TFR-EVU and VER-TFR-MAV for overdue definitions.","required":["isOverdue"],"properties":{"isOverdue":{"type":"boolean","title":"Is Overdue","description":"True if the vulnerability is overdue."},"explanation":{"type":"string","title":"Explanation","description":"Reason for the overdue status."}},"if":{"required":["isOverdue"],"properties":{"isOverdue":{"title":"Is Overdue","description":"True if the vulnerability is overdue.","const":true}}},"then":{"required":["explanation"]}},"supplementaryRiskInformation":{"type":"string","title":"Supplementary Risk Information","description":"Per VER-RPT-VDT field 11 and VER-RPT-NID."},"painReductionEvents":{"type":"array","title":"PAIN Reduction Events","description":"History of completed PAIN-rating reductions for this vulnerability per VER-RPT-VDT.","items":{"$ref":"#/$defs/painReductionEvent"}},"finalDisposition":{"type":"string","title":"Final Disposition","description":"Omit if still active.","enum":["Fully Mitigated","Partially Mitigated","Remediated","False Positive"]}}},"acceptedVulnerabilityInfo":{"type":"object","title":"Accepted Vulnerability Info","description":"Required information for a single accepted vulnerability per VER-RPT-AVI.","required":["vulnerabilityDetail","acceptanceRationale"],"properties":{"vulnerabilityDetail":{"$ref":"#/$defs/vulnerabilityDetail"},"acceptanceRationale":{"type":"string","title":"Acceptance Rationale","description":"Explanation of why this is an accepted vulnerability."}}},"reportPeriodDateTime":{"type":"object","title":"Report Period","description":"From and To dates for the report period.","required":["from","to"],"properties":{"from":{"type":"string","format":"date-time","title":"From","description":"Start date for the report period."},"to":{"type":"string","format":"date-time","title":"To","description":"End date for the report period."}}},"reportPeriodDate":{"type":"object","title":"Report Period","description":"From and To dates for the report period.","required":["from","to"],"properties":{"from":{"type":"string","format":"date","title":"From","description":"Start date for the report period."},"to":{"type":"string","format":"date","title":"To","description":"End date for the report period."}}}}}