Start from the deadline
Work is ordered by impact, exploitability and the clock your framework sets.
Managed remediation, before the deadline
Every framework puts a clock on remediation. Managed remediation puts Quzara engineers inside your NISTcompliance.ai queue to fix, mitigate and document, so the evidence closes the loop before the deadline does.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
The clocks
Remediation deadlines by framework
Swipe to see every column
| Framework | Clock | Source |
|---|---|---|
| FedRAMP Class D | PAIN-5, likely exploitable and internet-reachable: reduce the risk within 12 hours of evaluation (should) | VDR-TFR-PVR |
| FedRAMP Class C | Same finding: within 2 days (should) | VDR-TFR-PVR |
| Known Exploited Vulnerabilities | By the due date in the CISA KEV Catalog (should) | VDR-TFR-KEV, CISA BOD 26-04 |
| CMMC Levels 2 and 3 | Close the POA&M within 180 days of Conditional status | 32 CFR 170.21 |
| GovRAMP | POA&M items within 30, 90 or 180 days for high, moderate and low | GovRAMP FAQs |
Sources: VDR rules, 32 CFR 170.21, GovRAMP FAQs. Sources checked Oct 23, 2026. Not a substitute for the official text.
How it works
Your queue, our engineers
Mitigate, then remediate
Engineers apply mitigations first when that beats the clock, then remediate and verify.
Evidence that closes the loop
Every action is recorded against the finding, ready for your report and your assessor.
Go deeper
Remediation guide
VDR and VER as an operating program
Detection, evaluation and remediation on the FedRAMP clock.
Read the guide →Questions
Common questions
Do we keep control of our environment?
Yes. Remediation runs through your change process and access controls, and every action is recorded against the finding.
Book a demo
Stop losing the clock
We will walk through how findings are worked against the deadlines that apply to you.