VDR & VER
Adopt the vulnerability detection, response, evaluation, and reporting rules.
For existing FedRAMP Rev5 providers
Get your Rev5 program ready
for the new FedRAMP rules.
Manage vulnerabilities, maintain your certification package, and share the evidence agencies and assessors need. Put the Consolidated Rules into practice with Boundera.
Three dates to plan around
Official Rev5 scheduleThe next set of rules
Certification and assessment, cryptographic module use, incident communication, and significant changes.
Complete VDR/VER adoption
The extension requires a corrective action plan that includes notice to all agencies.
How do the grace periods work?
VDR/VER: existing providers unable to meet December 7 may maintain certification through March 7 under a corrective action plan that includes agency notification. March 7 is specific to VDR/VER. Read the adoption notice.
The January rules have separate grace periods: June 1, 2027 for cryptographic module use, incident communication, and significant changes; the first FedRAMP independent assessment started after January 1 for certification, independent verification and validation, and minimum assessment scope.
Other requirements, including package formats and certification data sharing, phase in later in 2027. Check the full schedule for your program.
01 / Manage vulnerabilities
Work through findings in batches.
Keep reporting connected.
Scanner findings pile up across tools and tickets. Evaluating each one, tracking the response, and rebuilding reports by hand takes time away from resolving the risk.
How Boundera helps
Bring findings and service context together. Review findings in batches, stage evaluation and response instructions, and retain the evidence behind your team’s decisions.
- Evaluate reachability, exploitability, and agency impact.
- Review proposed actions and resolve missing context.
- Track response plans, deadlines, and remediation evidence.
What you getBatch VDR workflows. Exportable VER reports.
Explore vulnerability management Vulnerability Detail Report, Accepted Vulnerability Info, and Historical VER Activity, backed by maintained evaluation and response records.
From finding to reportingWorkflow overview
BounderaVULN-1042 · SAMPLE
- 01 / FindingVulnerable dependency in a public API
AWS Inspector · public-api · High source severity
- 02 / EvaluationProvider evaluation recorded
Reachable · Likely exploitable · N4 agency impact
- 03 / ResponsePatch and validate the deployment
Infrastructure team · Planned · Validation pending
- 04 / ReportingDecisions and open work stay together
Finding + evaluation + response history
02 / SSP to SDR
Bring your SSP forward.
Keep your SDR current.
SSP narratives, control evidence, and assessment records drift apart. Each package update becomes another round of gathering documents and reconciling what changed.
How Boundera helps
Import supported SSP content, inspect the source behind each proposal, and approve what belongs in your control and rule records. Connect evidence, resolve gaps, and prepare your SDR and certification package from the work your team maintains.
- Import SSP narratives and parameters with source context.
- Maintain boundary, cryptographic module, and assessment records.
- Keep package versions for later review.
What you getYour SDR and Certification Package Overview.
Explore SSP to SDR Export the Security Decision Record and CPO in JSON and human-readable HTML, alongside ongoing certification and supporting reports.
Certification PackageProduct screenshot
Security Decision Record + Certification Package OverviewHuman-readable records and machine-readable JSON.
03 / Share your package
Give agencies and assessors
a clear way to review.
Evidence gets scattered across attachments and folders. Reviewers ask for the same records again, while your team tracks which version they received and who still needs access.
How Boundera helps
Share certification data through a Trust Center with controlled access. Give assessors a dedicated workspace for evidence requests and review records, and keep the supporting artifacts connected to your package.
- Control public visibility and protected reviewer access.
- Work through evidence requests and assessor feedback.
- Retain access history and package versions.
What you getA shared package that reviewers can use.
Explore evidence sharing An access-controlled Trust Center, linked certification documents and evidence, an assessor workspace, and a sharing audit trail.
Your Trust CenterSharing settings
Assessor workspaceEvidence requests
Product-guide screenshots with demo data.
Build on your existing environment
Make the handoffs clear.
Start with the tools your team already uses. Map where findings come from, who owns each decision, and how remediation moves forward.
Detection & asset context
Findings, affected resources, and supporting technical evidence.
Evaluation & reporting
Contextual decisions, response obligations, and maintained records.
Engineering follow-through
Owners, agreed ticket contents, progress, and evidence of the outcome.
Decide which data belongs in each system.
Review permitted fields, access, and record references with your security team. Connector availability and custom ticketing work are confirmed for your deployment.
Pricing for your Rev5 transition
Start with VDR and VER. Add Consolidated Rules workflows, then KSI validation. Each annual plan includes the one before it.
A fit for your security boundary
Know where your
security data goes.
Review hosting, access, AI processing, and retention before connecting your environment. Choose the deployment model that fits your team’s requirements.
Managed hosting. Bring your own AI key.
- Your OpenAI or Anthropic API key, or Amazon Bedrock.
- AWS U.S. hosting; encrypted data and credentials; organization-scoped access.
- Boundera does not train AI on your data.
AI context goes to your provider. See our privacy policy for processing and retention.
Before you get started
A few clear answers.
Is this for an existing Rev5 program?
Yes. This page focuses on providers maintaining an existing FedRAMP Rev5 certification while adopting the Consolidated Rules for 2026. The rules have a phased adoption schedule; adopting them does not change your certification type. See the Rev5 schedule.
Do we have to start our SSP work over?
Your existing SSP and control work are the starting point. Boundera can import supported content into reviewable records, connect implementation details with evidence, and help prepare the certification package. Your team reviews what carries forward and resolves the gaps.
Can we keep our scanner and ticketing system?
Start with your existing environment. During a walkthrough, we map supported finding sources, record ownership, and remediation handoffs. Connector coverage, permitted ticket fields, and any custom integration are confirmed against your deployment.
Does Boundera replace our assessor or agency review?
Your team still owns its security decisions, external communications, and submissions. Boundera supports evidence preparation, controlled sharing, and assessor collaboration. Independent assessment and the FedRAMP certification decision remain with the responsible parties.
Walk through your Rev5
transition with us.
Bring your current workflow or SSP. We’ll map the upcoming requirements to your finding sources, package records, and review process.
Plan your Rev5 transition