Vulnerability Analysis
FedRAMP details vulnerability migration reporting and December security test
FedRAMP explains migration evidence and reporting exemptions for applicable cloud offerings.
- CDG website publication
- Official source publication
- Source checked
- Official source review
- Source reviewed Nov 12, 2026
CDG news update
FedRAMP’s November 10 notice addresses Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) migration. December 7, 2026 remains the migration deadline; incomplete required rules need corrective actions and timelines.
Grace runs through March 7, 2027; required corrective actions still apply. Completion planned after February 3, 2027 triggers remediation status. Extensions require an approved corrective action plan and a coordinated red-team assessment; unapproved noncompliance risks revocation.
The security inbox test is likely December 1–10, with an anticipated December 17, 2 p.m. Eastern response deadline. Collection exemptions include specified 20x profiles and implementation/Rev5 statuses; exempt offerings still acknowledge the test. Agency-provided offerings are exempt from VDR/VER.
For federal-cloud vulnerability analysts and RMF teams, review the applicable profile and evidence needs with system owners. This is planning analysis; FedRAMP certification does not confer an agency ATO.
- Notice / forecast ID
- FedRAMP NTC-0017
- Status at source check
- Published official notice; migration rules operative according to profile, with collection exemptions and tentative test schedule.