FedRAMP sets the path to VDR and VER enforcement: a December data call, a February review, and revocation after March 7

FedRAMP will ask every Rev5 cloud service for its vulnerability rule status in early December, with answers due December 17. Services that are not fully compliant need a corrective action plan, and after March 7, 2027, FedRAMP will revoke certification without an approved plan.

By FedXchange · November 6, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

In its Rev5 Community Update on November 4, 2026, the Federal Risk and Authorization Management Program (FedRAMP) explained how it will enforce, for Rev5 services (those built on Revision 5 of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 controls), two new rule sets: Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER). The rules become mandatory on December 7, 2026, for every cloud service that holds or seeks a FedRAMP Certification. FedRAMP said the plans it described are its best intent and may change.

What this means for cloud service providers: in early December, FedRAMP will send an emergency test message that asks for your status on each VDR and VER rule. Your answer is due December 17. If you have not fully put the rules in place, you need a corrective action plan (CAP). After March 7, 2027, FedRAMP will revoke the certification of any service that still has not met the rules and has no approved plan. A FedRAMP leader said in the video that FedRAMP does not want anyone to fail and that providers working in good faith without serious security problems will keep their certification.

What this means for agencies: FedRAMP's grace period is FedRAMP's alone. It does not change what the Cybersecurity and Infrastructure Security Agency (CISA) requires of agencies, and each agency still decides what risk it accepts.

How FedRAMP will enforce the VDR and VER rules

Sources: the FedRAMP Rev5 Community Update video (November 4, 2026) and FedRAMP Notice 0014.

Read the steps as text

By Tuesday, November 10, 2026. FedRAMP publishes a public notice and a web page with schemas, a comma-separated values (CSV) template, and a basic corrective action plan template. Examples and answers to common questions will be added over time.
December 1 to 10. Every provider receives an emergency test message asking for its VDR and VER status and sample vulnerability reports.
December 7. The VDR and VER rules become mandatory. This matches the agency deadline in CISA Binding Operational Directive 26-04.
December 17. Answers are due. FedRAMP lists a provider as in remediation if it has not fully met the rules and has no corrective action plan, or if its plan ends after February 3.
After February 3, 2027. FedRAMP reviews each corrective action plan one by one, asks for an update, and must formally approve it.
March 7, 2027. The grace period ends. Anyone not fully compliant is in remediation. FedRAMP revokes certification if there is no approved plan, the provider refuses or fails a red team assessment, or it does not show timely progress and open communication.

Why is FedRAMP enforcing this on December 7?

CISA issued Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk," on June 10, 2026. By December 7, 2026, agencies must begin evaluating and fixing vulnerabilities on its timelines. In FedRAMP Notice 0014, FedRAMP moved mandatory adoption of VDR and VER from June 1, 2027, to December 7, 2026, and set a grace period through March 7, 2027. The notice says the legacy monthly scanning process that most Rev5 services follow is not enough to meet the directive. Both rule sets are part of the FedRAMP Consolidated Rules for 2026 (CR26).

A FedRAMP leader said in the video that the December 7 date follows CISA's date and that FedRAMP does not expect CISA to change it. If CISA does extend its deadline, FedRAMP will move all of its own dates by the same amount.

The same leader described VDR and VER as a response to provider complaints about monthly scans that fix everything by Common Vulnerability Scoring System (CVSS) score. The new rules let a provider weigh context, such as whether a vulnerability can be reached from the internet, and focus on what is likely to affect agency customers.

What will the December data call ask for?

FedRAMP described a short status report, not a full system security plan. For each VDR and VER rule (about 60 in all, according to the video), the provider gives:

a status: fully implemented, partially implemented, not implemented, or not applicable;
a brief explanation of a few sentences;
for a rule that is not fully implemented, the risk to customers, what the provider does to reduce it, and any steps customers can take; and
a target completion date.

The provider also sends sample vulnerability reports. Answers must be text: CSV, JavaScript Object Notation (JSON), or Markdown. FedRAMP will not accept Excel workbooks or Word documents, and it will offer a web viewer and validation tools. A FedRAMP leader said the examples on the new web page will be generated with artificial intelligence (AI), and that they show the level of detail expected, not a required format.

"Fully implemented" has a set meaning. Every MUST and MUST NOT rule is met. Every SHOULD rule is addressed: the provider reviewed it, applied it where it fits, and wrote down its reasons where it did not.

Not answering the emergency test is its own problem. FedRAMP said it takes administrative action against a provider that does not respond, separate from any action for not meeting the rules. The video noted that a government shutdown in December would not change the due date; FedRAMP would process the answers when it reopens.

What makes a corrective action plan acceptable?

Plans sent on December 17 are not approved or rejected right away. FedRAMP said it will spend the last month before March 7 on them. After February 3, each plan must have formal FedRAMP approval, and FedRAMP hopes to meet with providers still working under one.

A provider may propose a completion date after March 7. If it does, it must agree to a red team assessment by FedRAMP, coordinated with CISA, to judge whether the slow progress puts the government at risk. A provider that will not agree has its plan rejected. In the video, FedRAMP said that a provider that has not fully implemented the rules and has no approved plan after March 7 will lose its certification and be barred from FedRAMP for one year.

What else should providers and agencies know?

Vendors are not an excuse. A provider cannot claim a dependency on a scanning vendor that has not adopted the rules. VDR and VER describe how a provider runs its own vulnerability management.
Open findings move over; closed ones do not. Providers need not move closed, historical plan of action and milestones (POA&M) records into VDR and VER reports. Open ones should move.
No sponsor agency. FedRAMP repeated that Rev5 continuous monitoring has no sponsoring agency. Providers work with all of their agency customers.
Talk to your agency customers. Agencies may still ask for more, or stop using a service, even inside FedRAMP's grace period.
Services run by agencies are handled differently. Cloud services that agencies offer to other agencies do not need VDR or VER. They follow their own authorizing official's direction on BOD 26-04. FedRAMP expects to issue an Offerings By Government rule set soon, as proposed in request for comment (RFC) RFC-0032.
Monthly rule updates. The CR26 changelog says FedRAMP will move to a monthly release of the rules, usually in the first week of each month. FedRAMP also said it will publish formal releases on GitHub.

The video also gave a review figure: 22 Rev5 packages were in active review, with an average of about 34 days in FedRAMP's review queue, not counting time spent waiting on the provider.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.