VER-TFR-MHRMUST
Monthly human-readable report
Class B, C and D providers must report vulnerability activity in a consistent, human-readable format at least monthly, covering all activity since the previous report.
- Home
- FedRAMP 20x
- VDR and VER
VDR and VER, on your Class clock
FedRAMP notice NTC-0014 makes Vulnerability Detection and Response and Vulnerability Evaluation and Reporting mandatory for every offering obtaining or maintaining FedRAMP Certification from Dec 7, 2026, with a grace period that ends Mar 7, 2027. NISTcompliance.ai runs detection, evaluation, response and reporting in one PAIN-rated queue.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
Response timeframes
How fast each Class should mitigate
Maximum recommended time from evaluation to mitigation for likely exploitable, internet-reachable vulnerabilities (LEV + IRV). Other categories allow longer.
Swipe to see every column
| Potential Agency Impact | Class A and B | Class C | Class D |
|---|---|---|---|
| PAIN-5 | 4 days | 2 days | 12 hours |
| PAIN-4 | 8 days | 4 days | 2 days |
| PAIN-3 | 32 days | 16 days | 8 days |
| PAIN-2 | 96 days | 48 days | 24 days |
VDR-TFR-PVR (should). Sources: VDR rules. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
What the rules require
The VDR and VER rules that drive the work
VER-TFR-MRHSHOULD
Machine-readable history
Recent history in JSON for automated retrieval: Class B monthly, Class C every 14 days, Class D every 7 days. Optional for Class A.
VER-TFR-EVUSHOULD
Evaluate quickly
Evaluate vulnerabilities within 14 days of detection for Class A, 7 for Class B, 5 for Class C and 2 for Class D.
VER-TFR-MAVMUST
Accepted vulnerabilities
Anything not fully mitigated or remediated within 192 days of evaluation is categorized and reported as an accepted vulnerability.
VDR-TFR-KEVSHOULD
Known Exploited Vulnerabilities
Providers should remediate KEVs by the due dates in the CISA KEV Catalog, per VDR-TFR-KEV, which references CISA BOD 26-04. VDR-CSO-AKE adds that new resources should not be deployed with KEVs.
VDR-CSO-FAVMUST
Process failures count
Problems or failures in your detection and response process must be treated as vulnerabilities.
Sources: VER rules, VDR rules. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
The platform
Detection to report in one queue
Your findings, one queue
Vulnerability findings are ingested, normalized and de-duplicated, with your scanner of record kept as the source.
IRV, LEV and PAIN
Each finding is evaluated for internet reachability, likely exploitability and Potential Agency Impact, with the Class clock started at evaluation.
Owners and deadlines
Mitigation and remediation tasks carry owners and Class deadlines. KEV due dates are tracked separately.
Need hands? →VER drafts and JSON
The monthly report is drafted for your team to review and submit, with JSON history ready for retrieval. It does not replace your sign-off.
Share it →Go deeper
VDR and VER guides
VDR and VER as an operating program
How detection, evaluation and reporting run day to day.
Read the guide →FedRAMP VDR and VER Requirements: Dec 7 Checklist
What to have in place before the deadline.
Read the guide →Questions
Common questions
When are VDR and VER mandatory?
From Dec 7, 2026 for every cloud service offering obtaining or maintaining FedRAMP Certification. Certification may be kept under a corrective action plan until Mar 7, 2027. After that, FedRAMP revokes certification for offerings not following VDR and VER.
What is a PAIN rating?
PAIN is the Potential Agency Impact N-rating, estimated for each vulnerability during evaluation. Together with internet reachability and likely exploitability, it sets the recommended response timeframe.
Is the monthly VER report required for Class A?
No. The monthly human-readable report (VER-TFR-MHR) applies to Classes B, C and D and is not on the Class A rule lists. Machine-readable JSON history (VER-TFR-MRH) is optional for Class A and recommended for Classes B to D.
Book a demo
Get ready for Dec 7, 2026
We will map your scanners, your Class timeframes and your first VER report in one session.