Cybersecurity
FedRAMP tightens VDR and VER requirements
The article said FedRAMP's VDR and VER rules raised scan frequency, shortened remediation deadlines and required machine-readable evidence, while presenting them as the first stage of a broader shift away from Rev5.
- FedRAMP said the Vulnerability Detection and Response rules would be mandatory for cloud service offerings obtaining or maintaining certification from 7 December 2026, with a grace period to 7 March 2027 for offerings under a corrective action plan.
- The article said machine-based resources would be scanned every 14 days at Class A, every 7 days at Class B, every 3 days at Class C and daily at Class D, while machine verification would run at least monthly for Rev5 and as often as every three days for higher 20x classes.
- It said remediation deadlines ranged from 192 days to 12 hours, depending on a vulnerability's PAIN rating and exploitability.
- The piece said providers had to assume exploits were automatable unless they had evidence otherwise, and had to treat failures in their vulnerability detection and response processes as vulnerabilities.
- It said FedRAMP described Rev5 as a legacy certification process being replaced by FedRAMP 20x and planned to stop accepting new Rev5 applications on 11 June 2027.
FedRAMP said the new rules would apply from 7 December 2026, with a grace period until 7 March 2027 for offerings already operating under a corrective action plan. The article said the old monthly scan and POA&M model had been replaced by class-based detection and validation.
Under the rules as described, machine-based resources were to be scanned at different intervals by class, from 14 days at Class A to once a day at Class D. Machine verification was to run monthly for Rev5 and as often as every three days for higher 20x classes.
The article said remediation times were tied to PAIN rating and exploitability, ranging from 192 days at the low end to 12 hours at the most severe end. It also said providers had to presume exploits could be automated unless they could produce evidence to the contrary, and that failures in the detection process itself counted as vulnerabilities.
It then said FedRAMP treated Rev5 as a legacy process being replaced by FedRAMP 20x, required the new rules for all stakeholders from 1 January 2027, and would stop taking new Rev5 applications on 11 June 2027. The closing note said Anecdotes held a FedRAMP 20x Class C certification as a Phase Two pilot participant and said its platform served more than 140 enterprise customers.
Named in this story
Companies
- Anecdotes
- sponsored the piece and said it held a FedRAMP 20x Class C certification
Governments and agencies
- FedRAMP
- issued the new vulnerability detection and response rules
- CISA
- had its BOD 26-04 notice responded to by FedRAMP
How the source tells it
A sponsored advisory piece mixed deadline pressure with promotional certainty about continuous compliance.
- urgency repeated near-term deadlines and countdown language drove the framing
- transformation hype the rules were cast as the start of a broader shift rather than a narrow compliance update
- vendor boosterism the close turned into a product pitch and self-description of the sponsor