In This Article
The clock is ticking. Monthly vulnerability scans are no longer enough, and FedRAMP is making that official.
On June 10, 2026, CISA released Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk. FedRAMP responded quickly with Public Notice NTC-0014, mandating that every certified cloud service provider (CSP) adopt the new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) standards by December 7, 2026. Certifications can be revoked for non-compliant CSPs after March 7, 2027.
This isn't a 20x-only conversation anymore. It applies to every FedRAMP-certified cloud service, Rev 5 included. We covered all of this on a recent episode of our podcast. Kenny Scott (CEO) and Isaac Teuscher (FedRAMP Lead) broke down what NTC-0014 and BOD 26-04 actually mean, how AI is driving the urgency, and what CSPs need to do to get ahead of it.
Watch the full episode here:
What is FedRAMP Notice NTC-0014?
FedRAMP Notice NTC-0014 is FedRAMP's direct response to CISA BOD 26-04. It formally mandates adoption of two new rulesets across all FedRAMP-certified cloud services:
- VDR (Vulnerability Detection and Response): Establishes how CSPs must detect, triage, and remediate vulnerabilities using a risk-based, exposure-aware approach.
- VER (Vulnerability Evaluation and Reporting): Establishes how CSPs must evaluate and report on those vulnerabilities to their agency customers.
These rules were originally introduced as part of FedRAMP 20x, giving Legacy FedRAMP systems the option to opt in. NTC-0014 changes that. Now they're required for everyone.
The FedRAMP VDR technical documentation outlines the specific automated checking criteria, including two that are getting a lot of attention: Internet-Reachability and Assume It's Automatable.
What is CISA BOD 26-04?
CISA BOD 26-04 is a binding operational directive telling all Federal Civilian Executive Branch agencies to stop treating every vulnerability equally and start prioritizing based on actual risk. It replaces both BOD 19-02 and BOD 22-01. The directive evaluates vulnerabilities across four factors:
- Asset Exposure: Is the vulnerable asset publicly reachable?
- KEV Status: Is it on CISA's Known Exploited Vulnerabilities Catalog?
- Exploit Automation: Can an adversary automate exploitation?
- Technical Impact: What's the potential damage if exploited?
The highest-risk combination, all four factors present, requires remediation within three days.
Lower-risk vulnerabilities can be deferred to the next scheduled system upgrade. The BOD 26-04 Implementation Guidance has more detail on the forensic triage steps agencies are expected to follow.
Why is This Happening Now? How AI Changed the Threat Landscape
This goes well beyond a compliance update. The urgency behind NTC-0014 and BOD 26-04 is driven by a real shift in how fast vulnerabilities get discovered and exploited.
AI has given threat actors dramatically more capability, not just advanced persistent threats, but lower-skilled actors too.
The speed of exploitation has compressed. The scale has expanded. Tools like Claude Mythos (which the US government has restricted due to cybersecurity concerns) are a window into just how powerful AI-assisted vulnerability exploitation can be.
At DARPA's AI Cyber Challenge at DEF CON, AI-assisted teams were able to find and exploit vulnerabilities in open source code, including brand new vulnerabilities that had gone undiscovered for years.
The takeaway: vulnerability discovery is no longer hard. What matters now is knowing which ones pose real risk to your system and responding fast. That's exactly what the VDR mandate is about.
The Key VDR Deadlines
The FedRAMP Consolidated Rules for 2026 (CR26) are now finalized. This brings together the VDR, VER, and all updated rules into one consolidated, machine-readable framework.
If you haven't looked at it yet, now is the time. See the CR26 timeline for the full milestone breakdown.
Also worth noting from FedRAMP NTC-0013: Legacy FedRAMP (Rev 5) is being sunset. No new Legacy FedRAMP certifications will be accepted after June 11, 2027, and existing certifications will fully retire by 2029.
What Does the New VDR Standard Actually Require?
"Internet Reachable" Has a Specific Definition
One of the most common misunderstandings around the VDR standard is what "internet reachable" actually means. It's not just "is there a public URL?" It means: can an unauthenticated user on the public internet reach that device?
It doesn't matter if there's a load balancer, gateway, or firewall in front of it. If an unauthenticated session can reach that device, even indirectly, it counts as internet reachable.
This catches a lot of teams off guard, especially with API keys and security tooling that has authenticated login screens sitting on publicly reachable infrastructure.
"Assume It's Automatable" Is a New Default
The VER ruleset introduces a new rule: assume exploits are automatable by default, unless you have evidence proving otherwise.
This is a meaningful shift from the old CVSS-based approach where teams would spend most of their time explaining why a vulnerability wasn't as bad as it looked. That narrative work is going away.
The Pain Scale and Remediation Timelines
FedRAMP VDR uses a pain scale (1 to 5) to determine how urgently a vulnerability needs to be addressed.
Here's how the timelines break down for a pain level 5 (likely exploitable and internet reachable):
- Class D (High): 12 hours
- Class C (Moderate): 2 days
- Class B (Low): 4 days
A pain level 5 scenario is effectively an all-hands incident, think Log4Shell. FedRAMP's 2-day timeline for Class C (Moderate) systems is realistic because if you're dealing with a known active exploit on an internet-reachable device, you're already working around the clock.
For a pain level 3 (likely exploitable, internet reachable, moderate impact), you have 16 days at Class C. If you have the tooling in place, these timelines are manageable. If you don't, none of them will feel comfortable.
What Should You Change About Your Vulnerability Management to Meet New Requirements?
The old FedRAMP approach was built around paper exercises: interviews with whoever happened to know the system, manual POA&M spreadsheets, and boundary diagrams that may or may not have matched what was actually deployed in Terraform.
That model doesn't work anymore. A few specific things to move away from:
- Monthly scans. The VDR mandate requires continuous, automated detection. Monthly scanning is explicitly called out in NTC-0014 as insufficient.
- CVSS-only triage. The whole point of BOD 26-04 is that CVSS scores alone don't tell you what's actually risky. A critical CVSS score on a non-internet-reachable, hard-to-exploit vulnerability is a very different problem than a medium score on something that's publicly exposed and on the KEV list.
- POA&Ms as a stalling mechanism. The old POA&M process was largely a way to document why you weren't fixing something and get sign-off. That's a lot of effort that doesn't actually improve your security posture. The new model is about understanding real risk and responding to it.
- Boundary diagrams that don't match reality. If your boundary diagram is maintained manually and doesn't reflect your actual infrastructure, it's obscuring the truth rather than telling it. That's the opposite of what agencies need from you.
How are Modern CSPs Doing Vulnerability Management?
The organizations in the best position to handle this transition have a few things in common:
- They've centralized vulnerability detection and response.
Individual product teams don't get to choose their own scanning tools or set their own thresholds. There's an organization-wide policy: these are the hardened images you use, this is the scanning tool, and these are the minimum standards everyone meets. - They built toward small, clean boundaries from the start.
Keeping your boundary small, containers over traditional OS, infrastructure as code, hardened images, scanning in the pipeline, means fewer vulnerabilities to manage and faster time to remediation.
If you can design away entire classes of vulnerabilities before they ever reach production, you've already won a significant portion of this battle. This is a core part of what the FedRAMP 20x model is built around. - They use modern cloud-native security tooling.
Tools like Wiz, Orca, and Upwind show you how vulnerabilities chain together into real attack paths. That's what the VDR standard is asking for: not a list of findings, but an understanding of actual risk in your environment. - They're being transparent with their agency customers.
This one is counterintuitive but important. Agencies evaluating CSPs aren't looking for a dashboard full of green. They know every system has vulnerabilities. What they're looking for is evidence that you understand your risks, you're tracking them honestly, and you're remediating with integrity. A trust center that shows real data, including the occasional red, builds more confidence than one that always looks clean.
The Incident Response Overlap
One more thing worth noting: the lines between vulnerability management and incident response are blurring. Under the VDR standard, a pain level 5 vulnerability that's internet reachable and likely exploitable is effectively an active incident.
The teams handling those two functions need to be working closely together, with threat intelligence feeding directly into vulnerability triage decisions.
If those are still siloed teams in your organization, it's worth rethinking the structure.
How Paramify Can Help with the VDR Mandate
The VDR mandate is a shift from point-in-time compliance to continuous readiness. That's exactly the model Paramify is built around.
Paramify alerts you to Likely Exploitable Vulnerabilities (LEVs) and Internet-Reachable Vulnerabilities (IRVs) instantly, so you can prioritize the pain level 5s and automate fixes for lower-priority findings without manually sifting through scanner output. The platform connects your vulnerability data to your SSP and POA&M management in one place, keeping everything current as your environment changes rather than requiring a manual update cycle every month.
If you're working toward FedRAMP 20x or trying to get your Legacy FedRAMP continuous monitoring in shape before December, request a personalized demo to see how Paramify can support your VDR standard end to end.
.svg)
.svg)
