New rule FedRAMP VDR/VER

VDR and VER are mandatory on December 7

Every FedRAMP cloud service must move from monthly scans to risk-based vulnerability management. Find your gaps now, with a FedRAMP 3PAO.

Book a readiness call See what changes
34days until the rules become mandatoryCountdown
Dec 7VDR and VER required for every FedRAMP cloud service (2026)Deadline
Mar 7Grace period ends; certification revoked if not compliant (2027)Grace ends

What changes

Five rules replace the monthly scan

FedRAMP says monthly scanning on a fixed clock is no longer enough. Every finding is now ranked by real exposure.

Before

Monthly scans and POA&Ms on a fixed remediation clock, regardless of reachability or exploitability.

  1. 01

    Internet reachability

    Is each vulnerability reachable from the internet?

  2. 02

    Exploitability

    Is it likely exploitable, including KEV status?

  3. 03

    Assume automation

    Treat exploits as automatable unless proven otherwise.

  4. 04

    KEV timelines

    Fix Known Exploited Vulnerabilities on BOD 26-04 timelines.

  5. 05

    Continuous response

    Mitigate and remediate continuously, not monthly.

How we help

Ready before December 7

Three steps with a FedRAMP 3PAO.

Step 101

Readiness call

30 minutes on your process, tooling and certification path.

Step 202

Gap assessment

Your current program mapped against each rule, with the gaps that matter most.

Step 303

Agency-ready plan

A prioritized remediation plan, with recommended next steps to address gaps.

FAQ

Common questions

Who has to follow the rules?

Every cloud service obtaining or maintaining FedRAMP Certification, from December 7, 2026 (FedRAMP NTC-0014).

What if we're not ready by December 7?

You can keep certification under a corrective action plan until March 7, 2027, with notice to all agencies. After that, FedRAMP says certification will be revoked.

Are monthly scans enough?

No. Scanning still matters, but each finding must now be evaluated and acted on by reachability, exploitability and impact.

Why is this tied to CISA?

CISA BOD 26-04 (June 10, 2026) sets risk-based remediation timelines. FedRAMP aligned VDR/VER to it, which moved the deadline up from 2027.

Can Fortreum help us prepare and also assess us?

Fortreum can discuss readiness and assessment options. Any assessment engagement must meet applicable 3PAO independence requirements.

30-minute call

Know where you stand before the deadline

Talk to a FedRAMP assessor about your program against the new rules.

  • Where you stand on all five rules
  • Which gaps to close first
  • Your options if you won't be ready

Sources, checked November 1, 2026. Confirm current text at fedramp.gov.