In This Article
Watch for the full VDR/VER breakdown from Isaac Teuscher
What are FedRAMP VDR and VER, and how are they different? The short version: VDR is how you find vulnerabilities and fix them. VER is how you evaluate them and report on them.
Starting December 7, 2026, every FedRAMP provider has to do both. VDR and VER are one of the five deliverables under FedRAMP's 2026 rules. Here we’ll explain the difference and what you need to do to meet the deadline to keep your FedRAMP certification safe.
What is VDR?
VDR stands for Vulnerability Detection and Response. It means finding vulnerabilities on a persistent, ongoing basis and understanding the risk each one poses to your system.
FedRAMP used to require a few specific scan types:
- Database scans
- Web application scans
- Host discovery scans
- An annual penetration test
VDR gives you more flexibility. Pentests, bug bounties, threat intelligence, and supply chain monitoring can all be part of how you detect vulnerabilities. There's one important catch: if your detection process fails, that failure counts as a vulnerability too.
What is VER?
VER stands for Vulnerability Evaluation and Reporting. It's how you rate each vulnerability your detection process finds. You evaluate every vulnerability on three factors:
- Likely exploitation. Is it likely to be exploited or not?
- Internet reachability. Can it be reached from the internet?
- Potential agency impact. How much harm could it do to an agency, rated on a PAIN level from N0 to N5?
When you evaluate, you have to assume that exploitation can be automated. You also have to report monthly, in both a JSON format and a human-readable format, showing how you're evaluating all of your vulnerabilities.
So VDR is how you discover vulnerabilities, and VER is how you rate them and make that information available to federal agencies.
Quick Compare: VDR vs VER
Certification class determines vulnerability remediation timelines
Within each FedRAMP certification class, the timeline for a given vulnerability comes from the same three VER factors: internet reachability, likely exploitation, and PAIN level.
PAIN rating scale
That third one is the PAIN rating, the Potential Agency Impact N-rating with 6 levels.
Source: VER-EVA-EPA in the Vulnerability Evaluation and Reporting ruleset.
N0 is newer than the rest of the ruleset. FedRAMP added it on October 5, 2026, to clarify that potential agency impact can be entirely mitigated or remediated. If you built your rating logic before October, check that N0 exists in it.
One more rule that shapes every evaluation: under VER-EVA-AIA, providers "MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise." The burden sits on you to prove a thing is hard to exploit, not on FedRAMP to prove it is easy.
VDR and VER reporting requirements
You’ll need a monthly JSON and human-readable report.
→ Learn how you can automate your CR26 deliverables
Why you need a risk-based approach
VDR and VER replace the traditional monthly scan and POA&M report. Under the old model, you ran a monthly scan, built a POA&M spreadsheet from it, and submitted it for your agencies to review.
A month is too long between reports and too long between evaluations. AI is helping threat actors move faster than ever, and a monthly cycle can't keep up.
That's why VDR and VER take a risk-based approach. You evaluate the risk of each vulnerability in near real time, and you patch based on three questions:
- Is it internet reachable?
- Is it likely to be exploited?
- What's the potential negative impact to the agency?
Those three factors drive everything: ongoing, risk-based detection, response, evaluation, and reporting to your federal agency stakeholders.
How Paramify helps with VDR and VER
Paramify acts as the data and reporting layer for VDR and VER. It takes in your detection data and handles the evaluation and reporting work.
- Rates every vulnerability on all three factors. Paramify classifies each finding as likely exploitable or not and checks whether it's internet reachable. It comes with FedRAMP default rules, and you can customize them. It also assigns each vulnerability a potential agency impact rating based on asset context.
- Calculates remediation deadlines automatically. Paramify replaces fixed POA&M windows with deadlines based on each vulnerability's ratings. It tracks every finding from open to remediated and flags anything due soon or overdue.
- Generates the reports agencies need. Paramify produces schema-validated, machine-readable JSON and audit-ready reports, so you don't have to build a spreadsheet every month. Agencies can pull the data through an API instead of waiting for a submission.
- Keeps the data current. Paramify automates evidence collection and validation by pulling data directly from your systems and checking it as it arrives. You get a continuous view of control health in place of point-in-time snapshots.
This is the same shift Vbrick made when it moved off spreadsheets and annual fire drills.
Read the full Vbrick case study, or see how Paramify handles VDR and VER compliance.
Paramify also holds its own FedRAMP 20x Class C certification, so we understand the pressure. More detail on the approach is on our VDR and VER compliance page.
Adoption required by December 7, 2026 deadline
On June 10, 2026, CISA released Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk. FedRAMP responded with NTC-0014, stating that it "will now require mandatory adoption of the new FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules by December 7, 2026.”
Legacy FedRAMP and FedRAMP 20x B & C systems need to meet this deadline:
Source: FedRAMP's Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rulesets, and the matching Rev 5 VDR ruleset.
Get compliant with VDR and VER requirements
VDR and VER change what it means to manage vulnerabilities for FedRAMP. You're no longer running a set list of scans and submitting a spreadsheet once a month. You're detecting vulnerabilities continuously, rating each one on risk, fixing it on a timeline that matches that risk, and keeping your agencies informed along the way.
That's a better way to protect federal systems, but it's a lot to do by hand. The providers who start automating now will have their detection sources, evaluation rules, and reporting in place before the deadline.
Paramify handles VDR and VER for your system, fill out the form below to get a demo or reach out with any questions — our team loves to help.
.svg)
.svg)
%20the%20requirements%20and%20who%20needs%20it.webp)