FedRAMP VDR/VER Migration: The December Progress Report, Then Three 2027 Dates

It moves providers "from legacy vulnerability scanning to an exposure and threat-based approach," in FedRAMP's words. The Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules ask providers to judge whether each vulnerability is likely reachable from the internet and likely exploitable, rather than relying on severity scores alone.

NTC-0014, published June 16, made both rulesets mandatory on December 7, 2026 for every offering "obtaining or maintaining FedRAMP Certification," to align with the Cybersecurity and Infrastructure Security Agency's (CISA) Binding Operational Directive (BOD) 26-04 of June 10. Adoption had been planned for June 1, 2027. The notice calls the "legacy monthly vulnerability scanning process" most Rev5 services follow insufficient. Among the rules it maps to the directive, VER-EVA-AIA requires providers to assume exploits are automatable unless they have evidence otherwise, and VDR-TFR-KEV requires remediating Known Exploited Vulnerabilities on BOD 26-04 timelines unless there are valid technical reasons not to.

A service counts as fully migrated, per FedRAMP's migration overview, when every MUST and MUST NOT rule is implemented and every SHOULD and SHOULD NOT rule is implemented or "otherwise addressed."

Six, and two of them are still marked "likely." The send and response dates come from FedRAMP's emergency test page, which says details can change until the day of the test.

The February 3 line is easy to miss. The target date a provider writes in December, not its progress on December 7, is what moves the listing into remediation.

Three attachments and an attestation. NTC-0017 asks for a VDR/VER Mini Security Decision Record (Mini-SDR) giving each applicable rule's status with a brief explanation and a corrective action plan where a required rule isn't implemented. FedRAMP publishes CSV and JSON versions with validation scripts.

The other two attachments are sample activity reports, one machine-readable (VER-RPT-PER) and one human-readable (VER-TFR-MHR), each with at least five vulnerabilities "of each type." The notice doesn't list the types, so check the templates on the migration site. The samples must use examples "in place of actual currently likely exploitable or internet reachable vulnerabilities." The emergency test page currently lists more for the form: the date of the latest corrective action target, the name and position of a senior official attesting to accuracy, and confirmation that the report is in the provider's package repository or trust center. FedRAMP hopes to use a form on help.fedramp.gov but may fall back to another tool, and the fields can change until the test goes out.

FedRAMP warns that it will likely collect these on a Class B system, so reports should stay high level. It treats every corrective action plan as pre-approved until it reviews it and notifies the provider, and says those reviews mostly begin in February 2027.

Seven kinds of listings, which receive a standard test instead. The emergency test page exempts 20x Class A, 20x Class B (CR26), 20x Class C (CR26), Initial Implementation, Rev5 Legacy Ready, Rev5 Agency Authorization In Process and agency-provided offerings; those only need to acknowledge the message. Our post on 20x Class C covers how to tell full and pilot certifications apart in the Marketplace.

Agency-provided offerings are exempt from the rules themselves because BOD 26-04 already binds them. Services still in agency authorization have their own path: after December 7, one that receives an agency Authorization to Operate (ATO) files a progress report with its Rev5 Certification application and, with an approved plan, can get a short-term certification with conditions. After March 7, 2027 FedRAMP won't begin review unless it has fully migrated.

Start with what FedRAMP will publish. Watch the Marketplace status of each cloud service your systems depend on, because an In Remediation label or a revocation shows there first, and FedRAMP says it will notify every agency customer of a provider that fails to respond to the emergency test. Then read the provider's progress report in its package repository or trust center, where FedRAMP currently plans to have it posted and where corrective action dates show which services may still be mid-migration in March.

What a remediation status or revocation means for an existing ATO or contract is not something NTC-0017 settles. Your authorizing official decides the risk question, and the contracting officer decides any contract question. Agencies are on their own BOD 26-04 clock for December 7, which our KEV catalog explainer covers.

Fill in the Mini-SDR now, run FedRAMP's validation scripts and build the two sample reports from example data. Name the senior official who will attest. Set corrective action dates by rule, and know which ones fall after February 3. Post the report where agency customers can reach it, and make sure someone watches the FedRAMP Security Inbox in early December, since a missed response means at least 30 days in remediation, and revocation if the follow-up isn't answered within 30 days. FedRAMP's last inbox test, reported in NTC-0016, put 10 certified offerings into remediation pending revocation.

FedRAMP calls this migration "only the first of many" its providers will need to make. An executive at assessment firm A-LIGN told Federal News Network that many providers are turning to third-party tooling because what they used before can't meet the new requirements, so tool changes belong in the plan dates.