U.S. flag

An official website of the United States government

VDR/VER Migration Progress Reporting and Upcoming FY27 Q1 FedRAMP Security Inbox Test

NTC-0017 published at Tue, 10 Nov 2026 20:00:00 GMT // Markdown Version

This FedRAMP Notice conveys critical information about the ongoing migration to FedRAMP’s new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules. It supplies frequently requested information about FedRAMP’s latest expectations along with a dedicated website with additional resources to help cloud services migrate to the VDR/VER and prepare migration progress reports.

This Notice targets FedRAMP Certified cloud services specifically, and contains information that is urgent and critical. Failure to review and take action based on this Notice will dramatically decrease your ability to supply a VDR/VER Migration Progress Report in a timely manner. Proper preparation based on the information in this Notice will allow most cloud services to entirely eliminate the risk of administrative action by FedRAMP related to the VDR/VER migration.

Note: Typical FedRAMP convention is to avoid use of acronyms or initialisms whenever possible, but writing out Vulnerability Detection and Response and Vulnerability Evaluation and Reporting 20x in this Notice would be a terrible idea. Instead, the short-hand “VDR/VER” is used throughout this document to refer to both rulesets.

Background and Motivation

On June 10, 2026, the Cybersecurity and Infrastructure Security Agency released Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk. BOD 26-04 established a deadline for moving the entire government away from traditional CVE/CVSS score-based prioritization with 30+ day response windows for vulnerabilities, stating:

Cyber threat actors exploit unpatched vulnerabilities, and their use of AI may further narrow the time defenders have to react between patch release and possible exploitation. As a result, we must take immediate action to harden American networks and ensure our cybersecurity practices, including our policies for applying patches, address modern and increasingly sophisticated cyber threats. This approach focuses patching efforts on the areas of highest risk rather than treating all vulnerabilities and systems equally.

In response, FedRAMP released NTC-0014 FedRAMP Response to CISA BOD 26-04 (Prioritizing Security Updates Based on Risk) on June 16, 2026. NTC-0014 synchronized the deadlines for FedRAMP’s Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules with BOD 26-04, requiring all FedRAMP Certified cloud service offerings to migrate to the VDR/VER by December 7, 2026.

FedRAMP understood at the time that this would require a considerable effort for many cloud service providers, especially those who developed government-specific versions of their cloud service offering that aligned with traditional government vulnerability management approaches that focused nearly entirely on CVE/CVSS scores while disallowing the consideration of context, reachability, risk, or mitigation. The urgency of the threat that made this aggressive deadline necessary 5 months ago has only increased since then, with the recent Black October hammering this threat home across the global infosec community.

Cloud service providers must have sufficient budget, planning, and engineering capability for the continuous operational improvements necessary to keep responding to this accelerating threat. They must also be able to assure federal government customers that they are doing so by meeting changing expectations for automated assurance over the coming years. The mandatory migration to the VDR/VER rules is only the first of many migrations that cloud service providers will need to make over the coming years; yearly paperwork exercises are no longer appropriate or sufficient in this era of continuously evolving threats.

FedRAMP Grace Periods and Administrative Action

The primary concern of the U.S. government is that cloud service providers with an active FedRAMP Certification migrate to the vulnerability management and reporting approach outlined in the FedRAMP VDR/VER rules swiftly, safely, and appropriately. FedRAMP will not take unnecessary administrative action against FedRAMP Certified cloud services that are working safely and in good faith to migrate to the VDR/VER rules. FedRAMP will provide support to those cloud services to help minimize adverse administrative action.

FedRAMP has previously noted that a grace period will be provided for all FedRAMP Certified cloud services through March 7, 2027. This grace period will remain in effect, with the following clarifications:

  1. All cloud services that are not fully migrated to the VDR/VER on December 7, 2026, must explain the corrective actions they will take for each rule, including target timelines.
  2. Any cloud service planning to complete the migration after February 3, 2027, will be placed into remediation and their Marketplace entry will show their status as “FedRAMP Certified (In Remediation)” until they notify FedRAMP that their VDR/VER migration is completed.

Any cloud service that has not fully migrated to the VDR/VER and is not operating under a FedRAMP-approved Corrective Action Plan on March 8, 2027, will have its FedRAMP Certification revoked and be banned from FedRAMP for one year.

FedRAMP is providing ample opportunities for cloud service providers to coordinate with FedRAMP to ensure they can continue to operate under a FedRAMP-approved Corrective Action Plan. We anticipate that only providers who have simply refused entirely to participate in this migration will be impacted by this level of administrative action.

Extended Conditional Grace Period

FedRAMP will also offer an extended conditional grace period on a case-by-case basis. If absolutely necessary, cloud services may target completion of their full migration after March 7, 2027, but their Corrective Action Plan must be approved by FedRAMP and they will need to agree to a red team assessment coordinated by FedRAMP.

FedRAMP will begin working with cloud services in February that need to take advantage of this extended conditional grace period.

Agency Authorization In Process Services

After December 7, 2026: Any cloud service that receives an agency ATO must support a VDR/VER Migration Progress Report along with application for a new FedRAMP Rev5 Certification. If the cloud service has not fully migrated, they must explain the corrective actions they plan to take. If FedRAMP approves the Corrective Action Plan, the cloud service will be eligible for a short-term FedRAMP Certification with conditions based on the Corrective Action Plan.

After March 7, 2027: FedRAMP will not initiate review of any cloud service that has received an agency ATO unless they fully migrate to the VDR/VER prior to applying for a new FedRAMP Rev5 Certification.

Note to Agency-Provided Offerings

Agency-provided offerings (such as those listed in the By Government, For Government section of the FedRAMP Marketplace) are exempt from FedRAMP’s VDR/VER rules.

These offerings are already strictly bound by CISA BOD 26-04 and are already adopting the necessary changes to meet CISA’s requirements, and we expect these offerings will be soon moving to a FedRAMP A-130 Class G Certification. Please follow instructions from your CIO and CISO on how to properly implement BOD 26-04 in alignment with agency-specific policies.

Additional information about Class G will be provided in an upcoming notice about the outcome of RFC-0032 Offerings By Government. FedRAMP acknowledges that it’s a little weird to keep talking about Class G before it has been formally announced, but we want to avoid confusion with how some of these rules will interact with that new type and class of FedRAMP Certification once it has been released.

VDR/VER Migration Resources

FedRAMP has published a VDR/VER Migration Resources site at https://fedramp.gov/vdr-migration. This site will be maintained for the duration of the VDR/VER migration period and contains additional critical information to help cloud services prepare for progress reporting.

As with all new FedRAMP documentation microsites, it includes a site-specific Changelog that can be monitored via RSS feed, and is generated from a public GitHub repository that can be monitored directly for updates. Each page includes an integrated comment system for users with GitHub accounts to open discussions directly on the page using Giscus, just like on the Consolidated Rules.

We have done our best to make this site easy and intuitive to navigate while focused entirely on VDR/VER migration resources. The site itself is generated from markdown content using the same static site generator (Zensical) as our other documentation sites, so folks will be familiar with the vibe. Please explore this site to help prepare, or point the Super Intelligence agent of your choice at the Sources page to get some help approaching it as appropriate.

VDR/VER Migration Progress Report

Tracking the migration progress of 500+ cloud services without creating an unnecessary burden on those same cloud services is a complicated task in the current FedRAMP environment. The Certification Data Sharing rules are designed to eliminate this problem by the end of 2027, eventually allowing FedRAMP to automatically review all the certification data for all cloud services to monitor and report on progress… but for now, without wide-scale adoption of the Certification Data Sharing and Security Decision Record rules, we still need to collect information proactively.

In early December, 2026, FedRAMP will use a quarterly Security Inbox Emergency Test to collect VDR/VER Migration Progress Reports from all applicable FedRAMP Certified cloud services. Cloud service providers will include the following information in their progress report:

  1. Implementation status for each applicable VDR/VER rule with a brief explanation, including a Corrective Action Plan for the rule if it is not implemented but must be. This will be provided as a VDR/VER Mini-Security Decision Record (Mini-SDR).
  2. A sample or example machine-readable vulnerability detection and response activity report required by VER-RPT-PER (Persistent Reporting), with at least 5 vulnerabilities of each type. This report must contain examples in place of actual currently likely exploitable or internet reachable vulnerabilities.
  3. A sample or example human-readable vulnerability detection and response activity report required by VER-TFR-MHR (Monthly Activity Report), with at least 5 vulnerabilities of each type. This report must contain examples in place of actual currently likely exploitable or internet reachable vulnerabilities.

FedRAMP may be directed to gather additional information between now and the formal progress collection planned for the FY27 Q1 Security Inbox Emergency Test. We will maintain a public list of all information to be collected on our VDR/VER Migration Resources site that is updated as soon as we are aware of any additional requirements. Requirements may be added or modified up until the Emergency Test notification is sent in early December, but we will only make changes if absolutely necessary.

Mini-SDR for Migration Progress Reporting on Rules

FedRAMP has designed a Mini-Security Decision Record (Mini-SDR) to support progress reporting for the VDR/VER, including both CSV and JSON versions. This enables simple programmatic generation for cloud services using modern engineering-based approaches or GRC automation tools while also supporting the significant number of cloud service providers that still use manual office productivity software to provide assurance information.

Each cloud service provider must provide FedRAMP with a VDR/VER Migration Progress Report using this Mini-SDR. This will be updated and maintained until the provider has migrated to the full Security Decision Record rules, at which point it will no longer be necessary.

Unlike the full Security Decision Record, the Mini-SDR supplies only a simple high-level overview of how each individual rule is addressed. These overviews should be responsibly written and relatively simple. They are expected to assure FedRAMP and agencies that you understand the rule, have considered its implications, determined its appropriate application in your environment, and implemented the appropriate application - or determined why implementation was not necessary and documented the resulting risk, in some cases.

If a rule is required but not fully implemented, additional information is necessary, such as a rule-specific Corrective Action Plan and timeline. These form the basis of the overall Corrective Action Plan, which can then be generated automatically from the Mini-SDR.

Detailed information about the schemas, templates, and fields is available on the VDR/VER Migration Resources site. This site also includes examples and simple validation scripts.

Notice of Upcoming Quarterly Security Inbox Test

This FedRAMP Notice also serves as the formal public notice of an upcoming quarterly Emergency Test message, as required by the Addressing FedRAMP Communication rule AFC-FRP-PNT (Public Note of Emergency Tests). This FY27 Q1 Emergency Test will be the mechanism FedRAMP uses to collect mandatory information on the progress of each cloud service’s VDR/VER migration.

  • December 1, 2026 through December 10, 2026: This is the likely timeframe for FedRAMP to send this Emergency Test message.
  • December 17, 2026, at 2pm Eastern Time: This is the likely deadline for providers to respond to this Emergency Test.

This Emergency Test will require FedRAMP Certified cloud services to supply information to FedRAMP via a web form. We are unfortunately still testing a few different approaches to this at the time of releasing this Notice. We will provide as much advance notice as possible of exactly what information will be collected and how on this FY27 Q1 Security Inbox Emergency Test page.

Failure to Respond and Administrative Action

Failure to respond to this Emergency Test will result in the cloud service offering being placed into the “FedRAMP Certified (In Remediation)” status on the FedRAMP Marketplace for no less than 30 days. The Marketplace page will be updated to note that the cloud service offering failed to respond appropriately to an emergency test from FedRAMP. All agency customers will be notified of the failure to respond.

The cloud service offering will receive a follow-up notification in their FedRAMP Security Inbox of this action, requesting that all required information be supplied to FedRAMP within 30 days along with a Corrective Action Plan that explains how the provider will properly implement the Addressing FedRAMP Rules requirements moving forward. If the provider completes these corrective actions and passes a follow-up FedRAMP Security Inbox test, they will be removed from remediation and restored to FedRAMP Certified. Providers that do not respond within the 30 day deadline will have their FedRAMP Certification revoked.