In This Article
Watch the video: Why Isn't CVSS Enough for FedRAMP Anymore?
Why isn't CVSS enough for FedRAMP anymore? If your team has sorted its vulnerability backlog by CVSS score for years, it's frustrating to hear that approach isn't going to get the job done anymore.
While CVSS still has a place, starting December 7, 2026, FedRAMP's VDR and VER rules ask a different question about every finding.
Below, we cover what CVSS measures, how FedRAMP's question differs, why the same CVE can carry very different risk in your environment, and how to prioritize vulnerabilities in a way that holds up after the deadline.
What does a CVSS score measure?
CVSS, the Common Vulnerability Scoring System, is a very common and widely used method for evaluating the severity of a vulnerability. It assigns a value from 0.0 to 10.0 that measures the technical severity of a computer system security vulnerability.
That number makes it easy to tell whether a vulnerability is a low, medium, high or critical risk:
CVSS is a useful metric, and it has been part of vulnerability and patch management processes for a long time. FIRST's specification describes the base score as reflecting a vulnerability's intrinsic characteristics, assuming the reasonable worst case across deployed environments.
In other words, the score describes the vulnerability in general, with no knowledge of your system.
How FedRAMP VDR and VER change vulnerability prioritization
FedRAMP has shaken things up with the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements.
These requirements include an evaluation of the risk that each vulnerability poses to your specific system.
So, while a CVSS score tells you how bad a vulnerability is in terms of its technical requirements, FedRAMP is asking how bad that vulnerability is specifically for the agencies using your service.
Those are two different questions, and they can lead to two very different patch orders:
Why does this matter? A generic severity score doesn't know your architecture, your data or how your service is organized.
For a deeper look at how the two rulesets split the work, see What Are FedRAMP VDR and VER?
Why the same CVE carries different risk across your architecture
Consider a CVE on a Red Hat operating system.
That operating system could be the core component of your service, where exploiting the vulnerability could lead to total compromise of your client data.
It could also run an ancillary support service, a staging component or a backend database backup process.
Same CVE, same CVSS score, with a very different risk to your customers.
That's why it's important to understand the risk a vulnerability poses based on how your architecture is organized, and whether exploiting it would lead to a negative impact for your customers.
This is where FedRAMP VDR extends beyond what CVSS provides. It's also why your scanner can't set PAIN levels on its own: the asset context comes from you.
What are likely exploitable, internet reachable and PAIN ratings?
FedRAMP asks you to rate every vulnerability on three things: whether it's likely exploitable, whether it's internet reachable, and its potential agency impact, or PAIN level.
The PAIN scale comes from rule VER-EVA-EPA in FedRAMP's Vulnerability Evaluation and Reporting rules:
One more rule shapes every rating. Under VER-EVA-AIA, you must assume exploitation can be automated unless you have evidence proving otherwise.
Is sorting by CVSS score enough after the VDR implementation deadline?
No. If you're still using CVSS score to sort your FedRAMP vulnerability backlog, that won't be a sufficient approach for managing and prioritizing vulnerabilities and patch cycles once the VDR and VER rules become required.
FedRAMP's Notice 0014 made adoption mandatory by that date to align with CISA's BOD 26-04, which bases remediation urgency on asset exposure, KEV status, exploit automation and technical impact.
The date applies to both initial and ongoing certification, and the grace period ends March 7, 2027. If you're cutting it close, here's what happens if you miss the December 7 deadline.
How to prioritize FedRAMP vulnerabilities beyond CVSS
What you need to do is understand the risk each vulnerability poses to your specific system.
Typically, that starts like this:
The exploit signals in step 3 come from outside your environment. CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of vulnerabilities that have been exploited in the wild.
The Exploit Prediction Scoring System (EPSS) estimates the probability that a published CVE will be exploited in the wild in the next 30 days.
FedRAMP's own evaluation factors (VER-EVA-EFA) point the same way, listing criticality, reachability, exploitability and known threats among the things to weigh.
Risk Matters: Why a CVSS 4.5 can matter more than a CVSS 9.0
There might be a vulnerability with a CVSS 9.0 or 10.0, a critical rating on the CVSS base score, where the exploit hasn't even been noticed in the wild.
That one is less likely to be exploited than a vulnerability that's maybe only a CVSS 4.5, but is known to be exploited by threat actors in the wild and would have a serious impact on your system if it were exploited.
Sort by CVSS alone and the 9.0 goes to the top of the list. Sort by risk to your system and the 4.5 does.
Keep CVSS as an input, just not the only one
For those reasons, CVSS can still be a valuable data input into your risk-based vulnerability condition engine. It just shouldn't be the only factor that determines your patching priority.
Keep CVSS as an input if it helps you, and add likely exploitable, internet reachable and PAIN to each finding and to your vulnerability process.
How Paramify automates FedRAMP vulnerability risk ratings
Paramify acts as the data and reporting layer for VDR and VER.
It takes in detection data from the scanners and tools you already run, then handles the evaluation and reporting work, so CVSS becomes one input among several.
Paramify holds its own FedRAMP 20x Class C certification, so we deal with these same rules for our own service.
See more on the VDR and VER compliance page, or read what Paramify does across the rest of your compliance program.
Moving from CVSS scores to risk-based FedRAMP vulnerability management
CVSS tells you how severe a vulnerability is in general. FedRAMP now wants to know how severe it is for the agencies using your service, and that depends on your architecture, your data and how your service is built.
Start with asset criticality and internet reachability, bring in exploit signals like CISA KEV and EPSS, and rate every finding for likely exploitability, internet reachability and PAIN.
Paramify can take on the evaluation and reporting work so your team can spend its time fixing what matters most.
Our team loves to help. Reach out with any questions you have about about VDR, VER or the PAIN scale, request a demo below.
Read more
- What Are FedRAMP VDR and VER? The Difference, the Deadline, and the PAIN Scale
- How to Choose a FedRAMP VDR Tool: Why Your Scanner Can't Set PAIN Levels
- What Happens If You Miss the December 7 FedRAMP VDR Deadline? The Grace Period, Explained
- Understanding BOD 26-04 and FedRAMP VDR: What You Need to Do to Stay Compliant
- How FedRAMP VDR Maps to RA-5 and SI-2 (and What Replaces Monthly ConMon Scans)
- AI Is Exploiting Vulnerabilities in 1.6 Days. Your Monthly FedRAMP Scan Can't Keep Up
FAQ
Is CVSS still used for FedRAMP?
Yes, as one input. CVSS can still feed your risk-based vulnerability process, but after December 7, 2026 it shouldn't be the only factor that sets your patching priority.
What doesn't a CVSS score account for?
Your architecture, your data and how your service is organized. The same CVE can sit on an internet-facing core service or a backend backup process and carry very different risk in each place.
What are LEV, IRV and PAIN?
They're the three ratings FedRAMP VER requires for every vulnerability: likely exploitable (LEV), internet reachable (IRV) and Potential Agency Impact N-rating (PAIN), which runs from N0 to N5.
When do FedRAMP VDR and VER become mandatory?
December 7, 2026, for both initial and ongoing certification. The grace period ends March 7, 2027.
What are CISA KEV and EPSS?
CISA KEV is CISA's catalog of vulnerabilities known to be exploited in the wild. EPSS estimates the probability that a published CVE will be exploited in the wild in the next 30 days. Both help show how likely exploitation really is.
Can a low CVSS score be a higher priority than a critical one?
Yes. A CVSS 4.5 that threat actors are already exploiting, on an asset where exploitation would seriously affect your system, can matter more than a CVSS 9.0 that hasn't been seen in the wild.Executive summary
.svg)
.svg)
