In This Article
December 7 is close enough that the real question is no longer how to be ready. It's what happens if you aren't. The short version: nothing happens on December 8. You enter a grace period that ends March 7, 2027, and that date is a hard stop that your progress, your plan, and FedRAMP's awareness of both will not move.
Our team walked through the consequences in the video above. Read on to learn what FedRAMP's deadline tiers actually mean, the remediation timeframes by certification class that nobody tells you to go look up, and whether losing certification is permanent.
What is the December 7 VDR deadline?
December 7, 2026 is the date the FedRAMP Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets become required.
FedRAMP moved them forward from the rest of the 2026 Consolidated Rules in NTC-0014, to line up with CISA Binding Operational Directive 26-04.
Both rulesets now carry the tag "Required (Mandated by CISA BOD 26-04)" on their rule pages.
A reminder, since they’re regularly confused. VDR is Vulnerability Detection and Response. VER is Vulnerability Evaluation and Reporting. Detection and response in one, evaluation and reporting in the other. They are separate rulesets with separate rule IDs.
→ Confused? Learn more about the difference between VDR and VER.
What FedRAMP VDR/VER deadlines actually mean
FedRAMP's Important Deadlines page shows you’re going to need VDR/VER in place for any new application after Dec 7. If you’re working toward FedRAMP Certification, you cannot overlook this.
Any currently FedRAMP Certified system also needs to get it implemented by then, with a grace period through March. After March, your certification is at risk.
Source: the VDR and VER rulesets and the Important Deadlines page.
What the VDR grace period does and does not buy you
Between December 7 and March 7 you keep your certification and keep operating. FedRAMP will request corrective action, your agency customers join the conversation, and you bring forward a plan describing how you will meet the requirements you are missing and by when. FedRAMP does not hand you this plan, you’re going to need to develop your own.
FedRAMP's language doesn’t mess around:
"There will be no extensions past the ending of the default grace period. The default grace period is a hard deadline that applies regardless of notification, corrective action, or progress."
I think they’re serious.
A corrective action plan does not extend March 7. Visible progress does not extend March 7. Not having been formally notified does not extend March 7.
There’s no negotiation in the grace period. It’s a countdown so you can keep selling while you get your system up to date, but time is ticking.
If FedRAMP determines you are not following the rules at the end of it, FedRAMP "will revoke their FedRAMP Certification with public notice."
Is losing certification permanent?
Not so much. FedRAMP's deadlines page says that it "will take no other punitive action, and cloud service offerings that lose their FedRAMP Certification in this way can regain it by demonstrating they are following the rules."
So revocation can be a temporary state while you get your program in place.
Basically, you are out until you can show you are in. Unfortunately, a gap in certification can mean lost contracts. We don’t recommend risking it.
What you need to know to be VDR Ready by December 7
1: Your certification class
VDR and VER are published per class, and the remediation timeframes are not the same at each one. If you are reading someone else's summary of the rules, check which class it describes.
2: Your remediation timeframes
These are the numbers nobody quotes, and they are the whole substance of the requirement. Each is measured from evaluation, and depends on the PAIN rating plus whether the vulnerability is likely exploitable (LEV) and internet-reachable (IRV).
Source: VDR-TFR-PVR on the Class B, Class C and Class D VDR rulesets. Longer timeframes apply when a vulnerability is not internet-reachable or not likely exploitable.
3: LEV, IRV, & the PAIN scale
Likely exploitable, internet-reachable, and PAIN. Every finding gets measured by all three. The combination is what selects the row and column above. Internet-reachable in particular is broader than publicly accessible, which we covered in our VDR explainer.
4: Your reporting
You’re going to need to provide the following:
- Human-readable activity reporting at least monthly is a MUST under VER-TFR-MHR.
- Persistent reporting of detection and response activity is a MUST under VER-RPT-PER.
- Under VER-TFR-MAV, you MUST categorize any vulnerability that will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.
What this means for your FedRAMP program
December 7 marks the end of the cycle time you’ve been used to.
A two-day window on a PAIN-5 finding that is likely exploitable and internet-reachable is not a window a monthly process can hit. Neither is it one you can hit if labeling a finding with its PAIN rating and reachability takes a person an afternoon of reading.
The requirement is not really "patch faster," it is "know what you are looking at within hours of finding it."
That is also why the grace period is less useful than it looks. Three months is enough time to write a corrective action plan and not enough to rebuild a vulnerability management pipeline from scratch while running it.
Providers who treat December 7 as the date they start are the ones for whom March 7 arrives as a surprise.
Key takeaways
How Paramify helps with the VDR and VER deadlines
The deadline demands a pipeline that can take a scan file and come back with, per finding, a PAIN rating, an internet-reachability determination, and an exploitability judgment, fast enough that a two-day window is survivable.
Paramify ingests vulnerability scan output and applies your environment's business logic to it: which resources sit on a path that processes internet payloads, which findings are likely exploitable in your architecture, and what the realistic impact on an agency customer would be.
The remediation clock then runs against the timeframe that combination selects for your class rather than against a generic severity score. The monthly human-readable report and the machine-readable historical record generate from the same underlying data, so what an agency sees matches what your program did.
We are subject to this ourselves. Paramify holds its own FedRAMP 20x certification, which means December 7 and March 7 are on our calendar too. More detail is on our VDR and VER compliance page.
Next Steps: Get VDR/VER by the deadline
December 7 starts a grace period, and March 7, 2027 ends it. Losing certification can cost you contracts. To meet it, every finding needs its PAIN rating, reachability, and exploitability as soon as it comes in, and your monthly reports should come from that same record.
Paramify does this from your scan data, using your environment’s architecture and the timeframes for your class. Book a demo ASAP to see how it works for your program.
Frequently asked questions
Do I lose my FedRAMP certification on December 8, 2026?
No. Missing it puts you into a grace period that runs to March 7, 2027, during which you keep your certification and operate under a corrective action plan.
Can the grace period be extended?
No. FedRAMP states there are no extensions past the end of the default grace period and that it applies regardless of notification, corrective action, or progress.
What happens after March 7, 2027?
An offering not following the VDR and VER rules by that date loses its FedRAMP Certification until it does follow them. FedRAMP revokes the certification with public notice.
Can I get certification back after it is revoked?
Yes. FedRAMP takes no other punitive action, and offerings that lose certification this way can regain it by demonstrating they are following the rules.
Does this apply to Rev 5 providers too?
Yes. The VDR and VER rulesets carry the same dates and the same remediation timeframes on both the Rev 5 and 20x paths. The exception is Class A, where neither ruleset is published.
Watch the full video walkthrough: What Happens If You Miss the December 7 VDR Deadline?
Learn More:
.svg)
.svg)
