Official source: Vulnerability Detection and Response (
VDR), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.In short
You must persistently find, track and manage all vulnerabilities in your cloud service offering, not only CVE-type findings from scanners. A failure in your own detection and response process counts as a vulnerability, and so does an out-of-date control statement in your Security Decision Record. Detection frequency and the time allowed to mitigate or remediate depend on your class: Class D has the tightest timeframes. These rules are mandated by CISA BOD 26-04, and providers must meet them by 2026-12-07, for both 20x and Rev5. The VDR works together with Vulnerability evaluation and reporting (VER). VER tells you how to rate each vulnerability (including its Potential Agency Impact N-rating, or PAIN) and how to report it. VDR sets the detection cadence and the mitigation timeframes that use that rating.
Who it applies to
Upstream describes the General Provider Responsibilities subset as applying “to all providers with FedRAMP Certifications of any type.”
Both subsets list Classes B, C and D, but several timeframe rules also state a Class A variant (
VDR-TFR-PDD, VDR-TFR-PCD, VDR-TFR-PVR, VDR-TFR-PSD, VDR-TFR-MVX). For Class A, FRC-CLA-MFR makes VDR-CSO-DET mandatory, and FRC-CLA-RFR recommends VDR-TFR-MVX, VDR-TFR-PCD, VDR-TFR-PDD, VDR-TFR-PSD and VDR-TFR-PVR. See FedRAMP certification.Key dates
The same dates apply to 20x and Rev5.What you need to do
General provider responsibilities
The notes on these rules also say:
- If you can’t fully mitigate or remediate a vulnerability, you SHOULD partially mitigate it promptly, progressively and persistently (
VDR-CSO-RESnote). - FedRAMP doesn’t treat “mitigation” and “remediation” as the same thing. Mitigation reduces risk, up to and including full mitigation. Remediation removes the vulnerability entirely. A fully mitigated vulnerability still exists until it is remediated.
- FedRAMP strongly discourages running a separate VDR process for FedRAMP reporting through an independent compliance branch, unless that process consumes data directly from the teams that actively maintain the service (
VDR-CSO-DETnote).
Timeframes
Differences by class
Detection and verification cadence by class
Each cell is the minimum frequency (“at least once every…”) stated upstream. A dash means the rule has no variant for that class.Mitigation and remediation timeframes by class
VDR-TFR-PVR (SHOULD for every class) sets the time you have, counted from evaluation, to reduce a vulnerability to a lower PAIN rating. The timeframe depends on the current PAIN rating (defined in VER-EVA-EPA), whether the vulnerability is likely exploitable (LEV) or not (NLEV), and whether it is internet-reachable (IRV) or not (NIRV).
Class A and Class B (identical)
Class C
Class D
Upstream calls these the “maximum timeframes from evaluation” for Class D.
The tables stop at PAIN-2: upstream gives no
VDR-TFR-PVR timeframe for PAIN-1 or PAIN-0. VDR-TFR-RMN says you SHOULD mitigate or remediate remaining vulnerabilities during routine operations, as you determine necessary. Separately, VER-TFR-MAV requires you to categorize any vulnerability that isn’t or won’t be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.
What FedRAMP staff have said
The mitigation clock resets after a meaningful mitigation. When a mitigation lowers a vulnerability’s PAIN rating, the new evaluation starts a new
VDR-TFR-PVR clock. In the example asked about, a Class C PAIN-3 LEV+IRV vulnerability mitigated to PAIN-2 LEV+NIRV on day 16 gets 128 days from that new evaluation, not from the original one. pete-gov also said the deadlines are “absolute worst-case.” pete-gov, 2026-09-08, discussion #146Deadlines run from evaluation, not detection. You report the time between detection and evaluation, and you’re expected to begin evaluation promptly. During the transition, you should re-evaluate older vulnerabilities, prioritize the serious ones and start reporting. Long-standing legacy POA&M items can generally move over as accepted vulnerabilities. pete-gov, 2026-10-13, discussion #146 and follow-up, 2026-10-14
Sampling is always optional.
VDR-CSO-SIR lets you meet monitoring requirements by sampling identical resources, such as containers from the same image. VDR-TFR-PSD still sets the detection frequency, which you can meet by scanning everything or by scanning samples. dan-fedramp, 2026-08-14, discussion #146VDR-TFR-NMV covers documentation, personnel and budgets. Staff confirmed a reading that non-machine resources (documentation, personnel and budgets) must be verified and validated every 3 months. This is distinct from the periodic policy review in SP 800-53 “-1” controls. Tracking last-verified dates in your Minimum Assessment Scope inventory makes sense, and you should summarize this work in your VDR activity reports. pete-gov, 2026-09-13, discussion #146The approach is yours to choose. For
VDR-CSO-DET, FedRAMP doesn’t prescribe a technical process (for example, whether SCA or SBOM scans must be included). You decide the approach, document it and share it so agencies can judge it. Staff strongly recommend logical groupings at scale to reduce noise. pete-gov, 2026-10-08, discussion #146What happens after 2026-12-07. FedRAMP will request a corrective action plan from services that don’t meet VDR/VER and move them to an “In Remediation” status. After 2027-03-07, FedRAMP will revoke certification from services that still don’t meet the rules. pete-gov, 2026-09-11, discussion #146
What “meeting VDR/VER” means on 2026-12-07. All applicable VDR and VER rules must be addressed. The VER Reporting outputs are sufficient evidence until your Security Decision Record is updated, and independent verification can come later in your normal assessment cycle. A SHOULD rule counts as addressed if you explain your decision and identify the risk to agency customers. pete-gov, 2026-10-05, discussion #146
How FedRAMP will check, and what it expects on 2026-12-07. On 2026-10-22, pete-gov said FedRAMP will ask you and review your required VDR and VER activity reports. It isn’t planning to evaluate your progress along the way. Full implementation is expected by 2026-12-07. If you aren’t done, you must supply a corrective action plan to finish by 2027-03-07. pete-gov added that the grace period applies only to FedRAMP Certification, and that it doesn’t protect you from agencies. Agencies must report their status under BOD 26-04 on 2026-12-07, and staff said that after past BOD deadlines, agencies have been forced to turn off non-compliant services within a few months. Discussion #146 comment
Detection time, drift and unpatched vulnerabilities. On 2026-10-20, pete-gov answered a provider with a continuous scanner. Track detection time as when the detection system found the vulnerability, not when a later system pulled or processed it. The
VDR-TFR-PVR timelines run from evaluation, so keep the gap between detection and evaluation as close to zero as you can. Whether IaC-managed resources are unlikely to drift is for your engineering team to decide, because it depends on how you deploy and manage them. If a vendor fix isn’t available yet, mitigate the vulnerability instead of only accepting it. Mitigation is now expected by default, and if you don’t mitigate, you need to explain the risk and impact to customers. Discussion #146 commentMitigated KEVs. In the same comment, pete-gov said a fully mitigated KEV still needs to be remediated, and gave 14 days. The published
VDR-TFR-KEV is a SHOULD that uses the due dates in the CISA catalog, even if the vulnerability is fully mitigated. It doesn’t state 14 days, so the rule text governs. In a follow-up on 2026-10-22, pete-gov said the SHOULD can rest on valid technical reasons you can’t compensate for, such as no vendor remediation or a fix owned by a leveraged provider. FedRAMP wouldn’t revoke certification over that, but agency customers may not accept your reasons. Discussion #146 follow-upAdopting VDR/VER is a significant change. Transitioning to VDR/VER should be handled as a significant change (through SCR or SCN), and staff expect most of these transitions to be adaptive. paulagosta, 2026-08-26, discussion #146, nicole-gov, 2026-10-05