{
  "$schema": "https://www.fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json",
  "certificationPackageOverviewUri": "https://example.invalid/fedramp/certification-package-overview.json",
  "generatedAt": "2026-07-29T15:00:00Z",
  "activeVulnerabilities": [
    {
      "providerTrackingId": "FRV-DEMO-001",
      "detection": {
        "detectedAt": "2026-07-02T14:15:00Z",
        "detectionSource": "Container image scanner"
      },
      "vulnerabilityDescription": "Outdated runtime library detected in the public API image. Fictional training record.",
      "potentialAgencyImpact": "Exploitation could disrupt availability for one agency using the fictional cloud service.",
      "evaluationCompletedAt": "2026-07-04T18:00:00Z",
      "isInternetReachable": true,
      "isLikelyExploitable": true,
      "currentRating": 2,
      "projectedNextReduction": {
        "estimatedAt": "2026-07-08T20:00:00Z",
        "targetRating": 1
      },
      "overdueStatus": {
        "isOverdue": false
      },
      "supplementaryRiskInformation": "Ingress filtering reduces reachability while the replacement image completes validation.",
      "finalDisposition": "Partially Mitigated"
    }
  ],
  "acceptedVulnerabilities": [
    {
      "vulnerabilityDetail": {
        "providerTrackingId": "FRV-DEMO-005",
        "detection": {
          "detectedAt": "2025-12-15T10:00:00Z",
          "detectionSource": "Software composition analysis"
        },
        "vulnerabilityDescription": "Unsupported reporting library with no vendor fix. Fictional training record.",
        "potentialAgencyImpact": "The affected component is isolated from direct customer traffic and cannot access federal customer data.",
        "evaluationCompletedAt": "2025-12-17T15:00:00Z",
        "isInternetReachable": false,
        "isLikelyExploitable": false,
        "currentRating": 1,
        "overdueStatus": {
          "isOverdue": false
        },
        "supplementaryRiskInformation": "Execution is blocked by policy and segmentation; replacement is scheduled in the next major release.",
        "finalDisposition": "Fully Mitigated"
      },
      "acceptanceRationale": "The vulnerability remains present after 192 days because no supported vendor fix exists. Validated controls fully mitigate the current risk while the component is replaced."
    }
  ]
}