FedRAMP Notice 0017 puts VDR and VER enforcement in writing: an In Remediation label, agency notices, and a cutoff for new Rev5 applications

In short:

• What changed: On November 10, 2026, the Federal Risk and Authorization Management Program (FedRAMP) published Notice 0017. It puts in writing how FedRAMP will enforce its Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules, which take effect on December 7, 2026, and which FedRAMP described in a video on November 4. It also adds terms that the FedXchange post on that video did not report.
• Who it affects: Providers of FedRAMP Certified cloud services, and the agencies that use those services.
• What providers must do: Answer an emergency test with a VDR and VER migration progress report. FedRAMP expects to send the test between December 1 and 10, 2026, and expects answers by December 17, 2026, at 2pm Eastern Time.
• What agencies will see: If a provider misses the test, FedRAMP will mark the service "FedRAMP Certified (In Remediation)" on the FedRAMP Marketplace, and every agency customer will be notified. A service that plans to finish its migration after February 3, 2027, gets the same label.
• What agencies must do: Notice 0017 does not say what agencies must do. BOD 26-04, the Cybersecurity and Infrastructure Security Agency (CISA) directive, already requires each agency to keep an inventory of its systems in FedRAMP Certified environments, get status updates, and make sure the directive is met. The VER rules ask agencies to review providers' vulnerability reports.
• The last date: A service that has not fully migrated and has no FedRAMP-approved corrective action plan on March 8, 2027, will lose its FedRAMP Certification and be banned from FedRAMP for one year.

What does Notice 0017 add to what FedRAMP said on November 4?

Notice 0017 puts in writing the enforcement steps FedRAMP described in a video on November 4: a label for services that finish late, a red team condition for a finish after March 7, 2027, and an exemption for services run by agencies. It also adds details and terms that the earlier FedXchange post did not report:

• The exact label. A service that plans to finish its migration after February 3, 2027, will show as "FedRAMP Certified (In Remediation)" on the Marketplace until it tells FedRAMP the migration is done.
• Plans count as approved until reviewed. The earlier post reported that each plan would need formal FedRAMP approval after February 3. The migration site says that every corrective action plan counts as pre-approved until FedRAMP reviews it and tells the provider otherwise. Those reviews will mostly begin in February 2027.
• More time is case by case. FedRAMP may allow a finish after March 7, 2027, case by case. The provider's plan must be approved by FedRAMP, and the provider must agree to a red team assessment coordinated by FedRAMP. FedRAMP will begin working with these services in February.
• A cutoff for new Rev5 applications. After December 7, 2026, a service that receives an agency authorization to operate (ATO) must send a progress report with its application for FedRAMP Rev5 Certification (the path based on Revision 5 of National Institute of Standards and Technology (NIST) Special Publication 800-53). If FedRAMP approves its plan, the service may get a short-term certification with conditions. After March 7, 2027, FedRAMP will not start a review unless the service has fully migrated before it applies.
• Class G for services run by agencies. Offerings that agencies provide, such as those in the Marketplace's "By Government, For Government" section, are exempt from the VDR and VER rules. The notice says CISA Binding Operational Directive (BOD) 26-04 already binds them. It tells them to follow their Chief Information Officer (CIO) and Chief Information Security Officer (CISO). FedRAMP expects them to move to a new certification it calls "A-130 Class G", and will describe it in a notice on the outcome of RFC-0032, Offerings By Government.
• A 30-day path from a missed reply to revocation, with notice to agencies. If a provider misses the reply, FedRAMP labels the service In Remediation for at least 30 days and notes the failure on its Marketplace page. Every agency customer is notified. The provider then has 30 days to send the information and a corrective action plan. If it completes those actions and passes a follow-up test, FedRAMP restores it to FedRAMP Certified. If it does not respond within the 30 days, FedRAMP revokes its certification.

What must the progress report contain?

The Required Information page lists three items:

1. A Mini Security Decision Record (Mini-SDR), in comma-separated values (CSV) or JavaScript Object Notation (JSON). It gives the status of each applicable rule with a brief explanation, and a corrective action plan and timeline for each required rule that is not fully in place.
2. A sample machine-readable activity report, as required by VER-RPT-PER (Persistent Reporting).
3. A sample human-readable activity report, as required by VER-TFR-MHR (Monthly Activity Report).

Each sample must hold at least 5 vulnerabilities or groups of each of nine types, such as internet-reachable, known exploited, and remediated. The samples must use examples, not real vulnerabilities that are likely exploitable or reachable from the internet.

The emergency test page says the form will most likely also ask for the name and position of a senior official who attests that the information is accurate. The page also says providers will most likely need to add the report to their package repository or trust center, so agency customers can read it.

Some services get only a standard test that asks them to acknowledge the message. These include FedRAMP 20x Class A, B, and C services, FedRAMP Initial Implementation, Rev5 Legacy Ready and Agency Authorization In Process services, and offerings run by agencies.

What do the documents ask of agencies?

Notice 0017 says all agency customers will be notified when a provider fails to respond. It does not say what an agency must do next. Other documents set the agency's part:

• BOD 26-04 makes each agency responsible for the systems it runs in FedRAMP Certified environments. The agency must keep an inventory of them, get status updates on the directive, and make sure the requirements are met through collaborative continuous monitoring. For FedRAMP Certified services, agencies must work through the FedRAMP Program Management Office.
• The VER rules say agencies should review providers' vulnerability reports at intervals that match their ATO (VER-AGM-RVR). They should also use that information in their own plans of action and milestones when their policies call for it (VER-AGM-MAP).
• Notice 0014 says that a service may keep its certification under a corrective action plan during the grace period, and that this will include notice to all agencies.

The notice says FedRAMP is tracking more than 500 cloud services through this migration. The FedXchange Marketplace tracker lists 553 FedRAMP Certified products as of November 12, 2026, and records each change of stage every day.

What is not known yet?

• The form. FedRAMP is still testing ways to collect the reports. It may use a form on help.fedramp.gov, or another form if that does not work.
• The final list of questions. FedRAMP says the requirements may change until the test is sent in early December. The migration site's changelog says its frequently asked questions are still in progress.
• How agencies are told. The notice says agency customers will be notified of a missed reply. It does not say who will tell them, how, or what the In Remediation label changes about an agency's use of a service.
• The label's start date. The notice does not say on what day a service planning to finish after February 3 will first show as In Remediation.
• Class G. FedRAMP has not yet published the rules for the new class.

Sources

• FedRAMP Notice 0017: VDR/VER Migration Progress Reporting and Upcoming FY27 Q1 FedRAMP Security Inbox Test (FedRAMP's page)
• FedRAMP VDR/VER Migration Resources: Overview
• FedRAMP VDR/VER Migration Resources: Data Collection via Emergency Test
• FedRAMP VDR/VER Migration Resources: Required Information
• FedRAMP VDR/VER Migration Resources: Changelog
• FedRAMP Notice 0014: FedRAMP Response to CISA BOD 26-04 (FedRAMP's page)
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk (CISA's page)
• FedRAMP Consolidated Rules for 2026: Vulnerability Evaluation and Reporting
• FedRAMP Consolidated Rules for 2026: Vulnerability Detection and Response
• FedRAMP RFC-0032: Offerings By Government (FedRAMP's page)
• FedXchange Marketplace tracker
• FedXchange: FedRAMP sets the path to VDR and VER enforcement (November 4, 2026)