In This Article
Does your vulnerability management process meet FedRAMP’s new CR26 requirements?
If your patching program still runs on CVSS base scores and a fixed remediation clock, it’s time for an update. CISA’s BOD 26-04, issued June 10, 2026, replaces that model for federal civilian agencies with one based on risk.
Paramify holds a FedRAMP Class C Certification, so we’re actively working on these requirements and helping many other organizations show how their processes meet VDR and VER requirements.
Here we’ll explain what BOD 26-04 requires, how FedRAMP’s VDR and VER requirements map to CISA’s four risk factors, and what to fix in your scanning and patching process so you can protect (or get) your certification.
Get the breakdown on how BOD 26-04 meets VDR
Key takeaways
- BOD 26-04 requires federal civilian agencies to prioritize vulnerabilities by risk instead of one patching clock.
- FedRAMP providers must adopt VDR and VER by December 7, 2026, with a grace period ending March 7, 2027.
- VDR finds and fixes vulnerabilities. VER rates each one on likely exploitation, internet reachability, and PAIN level, then reports monthly.
What is BOD 26-04?
BOD 26-04 is a binding operational directive from CISA called Prioritizing Security Updates Based on Risk. CISA issued it on June 10, 2026, and it requires federal civilian agencies to prioritize vulnerabilities by risk instead of patching everything on the same clock.
A binding operational directive is exactly what it sounds like. As the government's cybersecurity agency, CISA can issue them, and every federal civilian agency has to follow them.
Why is CISA moving away from CVSS-based patching?
For years, agencies set patching cycles around things like the CVSS base score. That score tells you how severe a vulnerability could be in the abstract.
It doesn't tell you which ones are most likely to be exploited or most likely to hurt a specific system, so effort doesn't always land on the findings that matter most.
BOD 26-04 replaces that with the four questions below.
What are the four risk factors in BOD 26-04?
CISA tells agencies to weigh these for every vulnerability:
- Public exposure. Is the asset publicly exposed?
- KEV status. Is the vulnerability on CISA's Known Exploited Vulnerabilities (KEV) list? CISA adds a vulnerability to that list as soon as it's known to be exploited in the wild, and KEV entries are typically prioritized for remediation within a few days.
- Automation. Can the exploitation be automated?
- Attacker control. If someone exploits it, how much control do they get over the information system?
The answers set the patching window. Depending on the mix, agencies end up with timelines ranging from about 1 to 3 days up to about 60 days.
Why does BOD 26-04 apply to FedRAMP providers?
Because agencies run on FedRAMP certified cloud services.
For an agency to respond to vulnerabilities based on risk, the services underneath it have to support that process.
FedRAMP's answer was NTC-0014, which makes the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules mandatory by December 7, 2026.
It covers Legacy Rev-5 FedRAMP and FedRAMP 20x Class B and C systems, and it applies to both getting certified and staying certified.
How do VDR and VER map to BOD 26-04?
FedRAMP took each of CISA's four factors and turned it into something a cloud provider can evaluate and report on.
The short version of the split: VDR is how you find vulnerabilities and fix them. VER is how you rate them and report on them. We cover the difference in more detail in VDR vs. VER.
The PAIN rating is the piece with the least precedent, so it's worth knowing the scale. PAIN stands for Potential Agency Impact N-rating, and it's your best assessment of what exploitation would do to the agencies using your offering.
What should you change before December 7?
A monthly scan and a POA&M spreadsheet can't keep pace when AI is helping threat actors move faster. VER replaces that spreadsheet with near real-time evaluation and monthly reporting. Here's what to confirm in your own process:
- Detection. VDR no longer prescribes a fixed list of scan types. Pentests, bug bounties, threat intelligence, and supply chain monitoring can all count. A failure in your detection process counts as a vulnerability too, so treat gaps there as findings.
- KEV intake. Make sure new KEV additions reach your team quickly and drive your timelines.
- Ratings on every finding. Likely exploitation, internet reachability, and PAIN level, for each vulnerability your detection finds.
- Automation assumption. Unless you have evidence that a vulnerability can't be automated, assume it can. Keep that evidence where you can find it.
- Remediation deadlines from ratings. Timelines come from those ratings and your certification class, not a fixed window.
- Monthly reporting. A human-readable report at least monthly, plus JSON for automated retrieval.
If you're a Class C provider, JSON history is a SHOULD at least every 14 days, so plan for that cadence even though it isn't a hard requirement.
How does Paramify help you meet VDR and VER?
Paramify isn’t the best fit for every CSP. Here's what we do, where we fit, and what your other options are.
Paramify acts as the data and reporting layer for VDR and VER. It sits on top of your detection data and handles evaluation and reporting:
- Rates every finding on all three factors. It classifies each vulnerability as likely exploitable or not, checks internet reachability, and assigns a PAIN rating based on asset context. FedRAMP default rules come built in, and you can customize them.
- Calculates remediation deadlines. Deadlines come from each vulnerability's ratings instead of fixed POA&M windows. Paramify tracks each finding from open to remediated and flags anything due soon or overdue.
- Generates the reports. It produces schema-validated JSON and human-readable reports, and agencies can pull the data through an API instead of waiting on a monthly submission.
- Keeps the data current. Evidence collection and validation pull directly from your systems, so you're working from a continuous view of control health instead of point-in-time snapshots.
Paramify also holds its own FedRAMP 20x Class C certification, which means these same clocks apply to us. Vbrick made the move from annual audits to ongoing reporting, and here's how their CIO describes it:
Read the Vbrick case study for the full story.
You can meet VDR and VER without Paramify. If your engineering team can build and maintain the rating logic, the schema-validated JSON output, and the deadline tracking, building in-house is a legitimate path. Just plan for upkeep, since the rules do change (the recent addition of PAIN level N0 is an example).
If you're evaluating any tool, including ours, ask four questions: Can you customize the default rating rules? Does the JSON validate against FedRAMP's schema? Does it track deadlines per finding? Can agencies pull data without a manual submission?
What to do next
BOD 26-04 moves federal agencies from patching on one clock to patching by risk, and FedRAMP is holding providers to the same standard through VDR and VER. That means rating every finding on likely exploitation, internet reachability, and PAIN level, setting deadlines from those ratings, and reporting monthly in JSON and human-readable formats.
Paramify handles the rating, the deadlines, and the reports, so your team spends its time fixing vulnerabilities instead of building spreadsheets. Request a live demo below and we’ll show you how it works. Have questions before jumping into a demo? Feel free to reach out, we love to help.
FAQ section
Each answer runs 40 to 60 words and stands on its own, which is what gets quoted. Use the question as an H3.
What is BOD 26-04?
BOD 26-04 is a CISA binding operational directive, issued June 10, 2026, that requires federal civilian agencies to prioritize vulnerabilities by risk instead of patching everything on the same clock. Agencies weigh public exposure, KEV status, automatability, and attacker control to set remediation timelines.
Does BOD 26-04 apply to FedRAMP cloud providers?
Indirectly, then directly. CISA’s directive binds agencies, but FedRAMP issued NTC-0014 requiring providers to adopt VDR and VER by December 7, 2026, so agencies can meet it. The requirement covers legacy FedRAMP and FedRAMP 20x Class B and C systems.
What is the difference between VDR and VER?
VDR (Vulnerability Detection and Response) is how you find vulnerabilities and fix them. VER (Vulnerability Evaluation and Reporting) is how you rate each finding on likely exploitation, internet reachability, and PAIN level, then report monthly to agencies. Together they replace the monthly scan and POA&M spreadsheet.
What is a PAIN rating in FedRAMP?
PAIN stands for Potential Agency Impact N-rating. It scores the expected effect of exploiting a vulnerability on agencies using your offering, from N0 (extremely unlikely to cause adverse effects) to N5 (a debilitating effect on more than one agency). You assign one to every finding under VER.
When is the FedRAMP VDR and VER deadline?
December 7, 2026. Optional adoption opened July 4, 2026, and a grace period ends March 7, 2027. VDR and VER are required for both initial and ongoing certification for legacy FedRAMP and FedRAMP 20x Class B and C systems.
What is the KEV list and how fast do you have to fix those vulnerabilities?
The KEV list is CISA’s catalog of Known Exploited Vulnerabilities, ones confirmed as exploited in the wild. CISA typically prioritizes KEV entries for remediation within a few days, and FedRAMP gives CISA’s KEV due dates precedence even if you evaluate a finding differently.
.svg)
.svg)
