In This Article
Watch the video: Deviation Requests and Vulnerability Acceptance Under CR26
If your company holds a Rev 5 FedRAMP Certification, you're probably asking two things right now: how do we make the move to VDR and VER, and what happens to the vulnerabilities we can't fix?
We were in DC recently, and everybody was still asking how to think about PAIN levels. That's the very beginning of this work, and the December 7, 2026 deadline is close. This article covers what PAIN levels actually measure, why VDR and VER change how you run your whole security program, what the teams handling this well are doing, and the new kind of deviation request every provider will report: the accepted vulnerability.
We want people to be successful whether they're using Paramify or not. We're team FedRAMP. Everyone embarking on this journey, we want you to succeed. If you have questions, reach out. We're happy to talk it through, show you what we're doing and give advice. We're an open book, because we think transparency is better security for everybody.
When do Rev 5 providers need FedRAMP VDR and VER?
The Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules become required on December 7, 2026, for providers obtaining a new FedRAMP Certification and for those maintaining one.
FedRAMP moved the date up to align with CISA BOD 26-04, and the grace period ends March 7, 2027. If you want the details on what that grace period does and doesn't buy you, see what happens if you miss the December 7 VDR deadline.
If you're a FedRAMP company and you don't know about VDR and VER yet, that's tough. Time is running out. You're going to need to build your telemetry. This won't live in a Word document; it would be literally impossible to do it that way.
The same goes for the rest of the CR26 deliverables. If you don't know what's needed, it's going to be hard. You're not going to be able to vibe code your way into this. It's a strategic decision about how your security program runs.
Are PAIN levels the same as risk levels?
No. PAIN levels and risk levels are different. It's easy to read PAIN as the new name for a risk level, and that was our first read too. But, PAIN measures something more specific.
PAIN stands for Potential Agency Impact N-rating, a scale from N0 to N5. It looks at the risk of the vulnerability, but it takes into account where that asset is. That's why everything around it matters: what the risk is, the solution and capability that address it, and the validation that proves the capability works.
It's all tied together.
VDR doesn't stand alone. You're not just replacing your spreadsheet mechanism with a new kind of mechanism. It's a complete overhaul of how you organize your security program. That happens to fit very well with how we've always approached security at Paramify.
For a fuller breakdown of the scale, read our full PAIN level explainer.
What FedRAMP providers succeeding with VDR and VER do differently
Not everybody is good at this yet. It's not easy if you don't want to learn. If you're digging your heels in and saying you'll do it your way, you can. You're going to suffer if you do.
You'll need to figure out what modern security package management looks like, because the bar has been raised for what agencies need to see.
The providers doing well right now have one thing in common: they jump in and learn. Nobody has all the answers from the start, not even us. The teams doing this well aren't waiting for all the answers. They're starting, and they're a little bit excited about it.
Problems teams face adopting CR26
The teams that struggle fall into a few groups.
- Teams digging their heels in. They're going to have a hard time.
- Teams whose organization isn't fully on board. We've worked with a handful of clients who are trying to explain to leadership why they need a new tool to manage the same thing they've managed for 20 years. They're explaining every change in FedRAMP: what it used to be, what it is now, and why the old way can't work anymore. Executive buy-in on that is hard, and it slows teams down.
- Teams that are waiting. This is the biggest group. They want someone to hand them a prescription for what to do, and that's not how it works anymore.
CR26 takes a certain amount of proactivity and decision-making. You have to be okay saying, "This is the decision we're making." The agencies will tell you they're good with it, or they aren't, and if they aren't, you adjust.
That requires better partnership with your authorizing officials, your 3PAOs and your people internally. In the end, that partnership builds better security.
What counts as a deviation request under FedRAMP VDR?
What's an exception? What's a deviation request? At Paramify, we use a tongue-in-cheek term for both: an excuse. It's the reason you're not going to do something, and it's a much easier thing to say.
There have always been four types of excuses. The new rules add a fifth.
What is an accepted vulnerability in FedRAMP VER?
All four of the original excuses are still there. What's new is what happens to a vulnerability you haven't addressed.
If it's still open after a set period, it becomes a new kind of excuse: an accepted vulnerability.
The VER rules say any vulnerability that isn't, or won't be, fully mitigated or remediated within 192 days of evaluation must be categorized as an accepted vulnerability. That label is applied automatically when you don't address an issue. You don't get to opt out of it.
And maybe that's okay. Remember, this one isn't about security. It's about transparency.
If you don't fix an issue, you're saying, "That's an accepted vulnerability, and we're telling you about it." Your monthly reporting includes the accepted vulnerability, its current PAIN rating and an explanation of why it's accepted.
So there are now five kinds of excuses you can have for a vulnerability as you're running scans.
We love that so much.
Your actions already say you've accepted the risk, because you didn't do anything about it. Now the reporting says so too.
Let's be honest. There are things we're working on, and that might be okay. We've found that it is.
Paramify holds a FedRAMP 20x Class C certification, with major agencies choosing to authorize us at the Moderate level. This approach works.
How Paramify automates FedRAMP VDR and VER reporting
Paramify was built for FedRAMP 20x and CR26, so VDR and VER aren't a bolt-on. Paramify's core architecture connects Risks directly to Solutions whose Capabilities are continuously Validated. That's the same chain PAIN levels depend on: the vulnerability, where the asset sits, and proof that what protects it works.
With Paramify's VDR and VER tool, every finding is tracked as an Issue from detection to final disposition, and every excuse, including accepted vulnerabilities, is recorded against the finding it explains.
If you're moving from Rev 5, you can also see how Paramify supports FedRAMP 20x Certification and what Paramify does across the rest of the risk management lifecycle.
Get ready for VDR, VER and accepted vulnerabilities
The move from Rev 5 to VDR and VER is a lot to take on before December 7. PAIN levels look at where a vulnerability lives, not just how bad it is. VDR changes how your whole security program is organized. And any vulnerability you don't fix within 192 days becomes an accepted vulnerability that you report. The teams doing this well are jumping in, making decisions and working closely with their agencies and 3PAOs.
Paramify can help you calculate PAIN levels, track every excuse and produce the reports FedRAMP expects. If you have questions, reach out. We're happy to talk it through, or you can request a demo below.
Read more
- What Are FedRAMP VDR and VER? The Difference, the Deadline, and the PAIN Scale
- What Happens If You Miss the December 7 FedRAMP VDR Deadline? The Grace Period, Explained
- Understanding BOD 26-04 and FedRAMP VDR: What You Need to Do to Stay Compliant
- AI Is Exploiting Vulnerabilities in 1.6 Days. Your Monthly FedRAMP Scan Can't Keep Up
- What Does Paramify Do?
FAQ
What is a PAIN level in FedRAMP?
PAIN stands for Potential Agency Impact N-rating. It rates the likely impact of a vulnerability's exploitation on agencies from N0 (extremely unlikely to have adverse effects) to N5 (debilitating effects on more than one agency).
Are PAIN levels the same as risk levels?
No. PAIN levels consider the risk of the vulnerability and where the affected asset sits in your cloud service offering.
What is an accepted vulnerability under FedRAMP VER?
Any vulnerability that isn't, or won't be, fully mitigated or remediated within 192 days of evaluation. Providers must categorize it as accepted and report it.
What do you have to report for an accepted vulnerability?
Your tracking ID, when and how it was detected, when evaluation finished, whether it's internet-reachable and likely exploitable, its current PAIN rating and why it's accepted.
What are the types of FedRAMP deviation requests?
Risk adjustment, operational requirement, false positive and vendor dependency, plus the new accepted vulnerability category under VER.
When are VDR and VER required for Rev 5 providers?
December 7, 2026, for both new and existing FedRAMP Certifications. The grace period ends March 7, 2027.
Can we manage VDR and VER in spreadsheets?
Not realistically. VDR and VER require persistent detection and machine-readable reporting, which means building telemetry rather than updating documents.
.svg)
.svg)
