FedRAMP VDR and VER: What CSPs Must Do Before December 7, 2026

If you hold a FedRAMP certification, or you are working toward one, you have a hard deadline on December 7, 2026. On that date the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets become mandatory for every cloud service offering. This applies whether you are on Rev 5 or 20x.

The grace period ends March 7, 2027. After that, FedRAMP can revoke certification for providers that have not transitioned.

This is not a 20x-only change. If you are a Rev 5 provider running monthly authenticated scans and filing a POA&M, FedRAMP has said directly that this process is insufficient.

Where the deadline came from

The chain runs from CISA to FedRAMP to you.

On June 10, 2026, CISA issued Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk. BOD 26-04 supersedes and revokes BOD 19-02 and BOD 22-01. It replaces severity-driven patching with risk-based prioritization built on exposure, known exploitation, automatability, and technical impact.

On June 16, 2026, FedRAMP published Notice NTC-0014, FedRAMP Response to CISA BOD 26-04. The notice sets the December 7 date and names the two rulesets that carry the directive down to providers: VDR and VER.

The logic is straightforward. Agencies must now prioritize remediation by risk under BOD 26-04. Agencies cannot do that for the services they consume unless providers supply the evaluation data behind it. A monthly scan report does not contain that data.

What each ruleset covers

The two rulesets split the work.

VDR (Vulnerability Detection and Response) covers finding vulnerabilities and doing something about them: detection coverage, cadence, response, and remediation timeframes. There are 17 requirements.

VER (Vulnerability Evaluation and Reporting) covers judging what you found and telling people about it: exploitability, internet-reachability, potential agency impact, and the reports that go to agencies and FedRAMP. There are 23 requirements.

Together they replace the operating model most providers run today.

The three evaluations you must perform

The center of the change is VER. Every detected vulnerability now needs three judgments before you can decide how fast to fix it.

All three are MUST requirements. Scanner severity does not satisfy any of them, because none of them is a property of the vulnerability alone. Each depends on where the vulnerability sits in your boundary and who your customers are.

Potential Agency Impact uses a five-level scale called PAIN:

• N1: minimal customer effects on one or more agencies
• N2: narrow customer effects on one or more agencies
• N3: a disruptive customer effect on one agency
• N4: a debilitating customer effect on one agency, or a disruptive effect on more than one
• N5: a debilitating customer effect on more than one agency

Remediation timeframes are now a matrix

Under the old model, remediation deadlines came from severity: 30 days for high, 90 for moderate, 180 for low. Under VDR-TFR-PVR, the deadline is a function of your certification class, the PAIN rating, internet-reachability, and exploitability.

Here is the fastest lane, an internet-reachable and likely exploitable vulnerability, across classes:

Two things stand out. A Class D provider with a critical internet-reachable flaw has twelve hours, which no monthly process can meet. And a not-likely-exploitable N2 finding gets 192 days at Class A, far longer than the old 30-day clock for a "high" severity.

That second point matters as much as the first. Risk-based prioritization is not only about moving faster. It is about not burning your engineering capacity on findings that do not threaten your agency customers.

Detection cadence is now explicit

Detection has its own clocks, and they also vary by class.

Note the third row. Evaluation is on a clock of its own. Finding a vulnerability and sitting on it for a month before rating it fails VER independently of whether you remediate on time.

Known Exploited Vulnerabilities get their own rule

VDR-TFR-KEV says providers should remediate Known Exploited Vulnerabilities according to the due dates in the CISA KEV catalog, as required by BOD 26-04, even if the vulnerability has been fully mitigated.

That last clause is the part teams miss. A compensating control that removes exploitability does not stop the KEV clock. There is also a companion rule, VDR-CSO-AKE, on avoiding KEVs in the first place.

Reporting changes shape

Under VER-RPT-PER, reporting becomes persistent: providers must report detection and response activity to all necessary parties continuously, summarizing all activity since the previous report. A human-readable summary is still required at least monthly under VER-TFR-MHR.

The monthly artifact does not disappear. What changes is that it becomes a summary of a continuous process rather than the process itself.

What this means if you are on Rev 5 today

This is the group most at risk of missing the deadline, because nothing about it feels like a 20x project.

Your current process probably looks like this: authenticated scans once a month, results triaged by CVSS score, findings tracked in a POA&M with 30/90/180-day deadlines, and a monthly package to your agency.

Against the new rules, four gaps show up:

1. No exploitability or reachability evaluation. CVSS is a severity score, not a determination of whether the flaw is reachable in your boundary or likely to be exploited.
2. No agency-impact rating. PAIN has no equivalent in the Rev 5 workflow.
3. Deadlines from the wrong input. Severity-derived due dates will be both too slow for genuinely dangerous findings and too aggressive for harmless ones.
4. Cadence gaps. Monthly detection cannot satisfy drift detection at Class C or D, and evaluation has its own clock regardless of class.

A practical sequence between now and December 7

You do not need to solve all 40 requirements at once. The dependencies run in one direction, so work in this order.

1. Inventory your detection coverage. VDR-CSO-DET requires systematic, persistent, prompt discovery across the offering. Find the resources nothing currently scans.
2. Add the three evaluations to your pipeline. Reachability, exploitability, and PAIN. Until these exist, no correct remediation deadline can be computed.
3. Recompute your due dates. Replace severity-derived deadlines with the PVR matrix for your class.
4. Wire the KEV catalog in. Due dates come from CISA, not from you, and they apply to mitigated findings too.
5. Fix the cadence. Match drift and complete-detection intervals to your class.
6. Convert reporting. Move from a monthly artifact to persistent reporting with a monthly human-readable summary on top.
7. Handle accepted vulnerabilities. VER-TFR-MAV and VER-RPT-AVI govern what you must record and disclose when a vulnerability is accepted rather than fixed.

The part that is easy to underestimate

The evaluations are per-vulnerability, continuous, and auditable. Three judgments on every finding, forever, each one defensible to an assessor.

For a small provider with a few hundred findings a month, that is a meaningful analyst workload. For a larger boundary it is not something a team does by hand. This is why the rules repeatedly point toward automation, and why VER-EVA-AIA ("Assume It's Automatable") is a MUST rather than a suggestion.

Boundera evaluates reachability, exploitability, and potential agency impact automatically from connected evidence, computes remediation deadlines from your certification class, and produces the persistent reporting VER requires. If you want to see where you stand against these 40 requirements first, the free gap assessment scores your readiness in about five minutes.

Key dates

• June 10, 2026: CISA issues BOD 26-04
• June 16, 2026: FedRAMP publishes NTC-0014
• December 7, 2026: VDR and VER become mandatory for all certified and in-process offerings
• March 7, 2027: grace period ends; certification may be revoked for non-compliance

References

• FedRAMP Notice NTC-0014: FedRAMP Response to CISA BOD 26-04
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• Vulnerability Detection and Response rules (VDR)
• Vulnerability Evaluation and Reporting rules (VER)
• VDR vs POA&M: how the operating model changes