FedRAMP VDR and VER Demand Continuous Security Evidence
FedRAMP's VDR and VER rules demand continuous security evidence, not just more frequent scanning. Under the notice that responds to CISA's Binding Operational Directive 26-04, all cloud service offerings obtaining or maintaining FedRAMP certification must meet the Vulnerability Detection and Response requirements starting December 7, 2026, with a grace period until March 7, 2027 for offerings operating under a corrective action plan. The issue for many programs is not the date itself; it is that the rules look like a scanning mandate but actually require a different operating model.
The old approach was a flat monthly scan paired with a Plan of Actions and Milestones (POA&M), a manual list of outstanding issues. FedRAMP now sets detection frequency by certification class. Rule VDR-TFR-PSD says machine-based resources, such as servers and virtual machines, must be scanned at least every 14 days for Class A providers, every 7 days for Class B, every 3 days for Class C, and at least once per day for Class D. Separate machine verification and validation checks run at least monthly for Rev5 holders, and as often as every 3 days for higher 20x classes.
Three provisions change engineering work most directly. Remediation clocks are tiered and tight: rule VDR-TFR-PVR sets fix deadlines according to a vulnerability's PAIN rating, a severity score, and whether it is known to be exploited. Deadlines run from 192 days at the low end down to 12 hours for a Class D offering with a PAIN-5 vulnerability that is both likely exploited and immediately remotely exploitable. A 12-hour clock is not a routine ticket queue service level; it is a paging and ownership question that must still work on a holiday weekend. The burden of proof is also inverted: rule VER-EVA-AIA, called Assume It's Automatable, requires providers to assume exploits can be automated by default unless they have evidence showing otherwise. Every deferral therefore needs a defensible artifact, produced at volume and on the same clock. Finally, process failures now count as vulnerabilities: rule VDR-CSO-FAV states that providers must treat problems or failures with their vulnerability detection and response processes as vulnerabilities. If the detection pipeline silently stops, that is not a quiet operational hiccup; the system that produces evidence is itself in scope. Read together, these provisions change the deliverable from more scans to a system that produces defensible, current, machine-readable answers about exposure and is accountable when it stops running.
December 7 is only the first installment. The Consolidated Rules for 2026 reorganized FedRAMP into rulesets and started a much larger transition. FedRAMP describes Rev5 as a legacy certification process that is being replaced entirely by FedRAMP 20x, and says providers are expected to follow new rules and adopt new FedRAMP Practices from 20x into their Rev5 offerings. The new rules become mandatory for all stakeholders on January 1, 2027, and FedRAMP stops accepting new Rev5 applications on June 11, 2027. This means VDR and VER are not a detour before the real transition; they are the transition, arriving in installments. Work scoped as get through December will be rebuilt in 2027, while work scoped as the first slice of continuous validation will transfer.
The structural changes show where the program is heading. The System Security Plan and its appendices give way to a Certification Package Overview and a Security Decision Record. Plans of Action and Milestones have been eliminated entirely and replaced with a list of Accepted Weaknesses. Continuous Monitoring is renamed Ongoing Certification because the old term had become synonymous with vulnerability scans, but the new requirements are far broader. FedRAMP has been direct about closing gaps where documents stood in for reality: providers will need to build or buy modern GRC, governance, risk and compliance, capabilities and populate them using automation based on real-world data where possible, rather than maintaining hand-crafted documents. Almost none of this is a demand for new security; access control, identity, encryption, logging, incident procedures, and training are largely intact. What changed is that describing them no longer counts as evidence of them.
The work is still compliance, but the deliverable is now engineering. Providers must hand over a set of running validations that pull from the systems holding the truth, such as cloud configuration, identity provider, a SIEM that aggregates security logs, CI/CD, the automated build and deployment process, and ticketing, and emit machine-readable results on a schedule. FedRAMP currently lists 49 Key Security Indicators across ten categories in CR26, and providers must persistently validate them; that is an entry requirement, so every transition plan is an automation engineering plan underneath. Someone has to own continuous operation: monthly monitoring had a due date and a natural rhythm of catching up, but a validation cadence either runs constantly or silently stops, and the difference is invisible until an assessor or customer finds it. Before building pipelines, teams should answer operational questions: who is paged when a validation fails, what is the response time, and who notices when an evidence source quietly changes its API. FedRAMP defines persistently as occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties, a description of an operating state rather than a date. Teams that build toward a single submission will build a system tuned for one moment and then rebuild it afterward.
Once evidence becomes structured data instead of narrative, it stops belonging to a single framework. The identity evidence that satisfies a FedRAMP indicator is the same evidence a SOC 2 auditor wants and the same evidence a large customer's diligence team asks for. Compliance stops being a set of parallel projects that each rebuild the same picture in a different vocabulary and becomes one substrate that many consumers read from. The economics invert: point-in-time compliance costs rise with every framework and region added, because each addition is more description to produce and maintain. Continuous validation costs more to stand up and barely more to run. December 7 is a hard date, but financial services supervisors, the EU's resilience and product security regimes, and enterprise procurement teams are converging on the same demand: show current state, not last year's description. FedRAMP arrived first because it had the clearest mandate and the least patience. For organizations that manage their own websites, cloud accounts, or infrastructure outside the FedRAMP program, the same principle applies: current, machine-readable evidence of your security posture is more useful than a yearly certificate.