FedRAMP's new Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules become mandatory on December 7, 2026—including for existing Rev. 5 providers.
38North helps cloud service providers assess their current vulnerability process, identify data and automation gaps, and build a practical path to VDR and VER readiness.
Talk with a FedRAMP specialist about your current process and next steps.
"*" indicates required fields
The traditional FedRAMP process focused heavily on scheduled scanning, severity ratings, remediation timelines, and recurring report submissions.
The new model requires more.
Providers must be able to evaluate vulnerabilities using the context needed to make faster, more defensible risk decisions—including:
Finding vulnerabilities is only the beginning.
The harder problem is connecting vulnerability data with asset context, threat information, system architecture, and response decisions quickly enough to determine what needs action first.
FedRAMP has announced mandatory adoption of VDR and VER for all cloud service offerings obtaining or maintaining FedRAMP Certification.
Providers must begin operating under the new vulnerability evaluation, response, and reporting model.
During the grace period, providers that have not completed adoption may maintain certification only under a corrective action plan, with agency customers notified.
Cloud service offerings that are not following the rules risk losing FedRAMP Certification.
The work required to meet the deadline may involve new data sources, integrations, decision logic, operating procedures, ownership, reporting, and automation. That work needs to begin before December.
Source: FedRAMP Public Notice NTC-0014.
38North helps you determine what already works, what needs to change, and what must be built before the new rules become mandatory.
This is a focused review of your current vulnerability operating model against the emerging VDR and VER requirements. We help your team answer four practical questions:
Determine whether your current tools and data can support vulnerability evaluation using asset context, reachability, exploitability, threat intelligence, impact, mitigation, and remediation status.
Evaluate how your team determines which vulnerabilities require immediate action, which can be mitigated, and what evidence supports those decisions.
Review ownership, escalation, mitigation, remediation, validation, and reporting across security, engineering, compliance, and leadership teams.
Assess whether your reporting and evidence can clearly demonstrate how vulnerabilities were evaluated, prioritized, addressed, and communicated.
Your readiness review can examine these areas:
How findings enter the process from scanners, penetration tests, configuration changes, security research, supply-chain issues, bug reports, and other sources.
Whether findings can be connected to the affected asset, service, environment, system boundary, data, and agency impact.
How your team determines whether internet-originated input can reach an affected component—not simply whether that component has a public IP address.
How KEV status, available exploits, automation, attack paths, and other evidence inform prioritization.
How your team reduces immediate risk when a vulnerability cannot yet be fully removed, and how full remediation is tracked.
Who evaluates findings, approves decisions, implements action, confirms completion, communicates status, and handles exceptions.
How evaluation results, risk decisions, mitigation, remediation, and unresolved issues are reported to FedRAMP and agency customers.
Where manual research, spreadsheets, handoffs, or disconnected tools could prevent the process from operating at the required speed and scale.
The goal is not another report that tells you the requirement exists.
The goal is to give your team a practical implementation path.
Depending on scope, your engagement can provide:
You will know what needs to change, who needs to own it, and what should happen first.
Bring together vulnerability findings from relevant sources.
Connect findings with assets, architecture, exposure, reachability, threat information, and impact.
Determine likely exploitability, urgency, and the appropriate response.
Mitigate immediate risk, remediate the vulnerability, and confirm the result.
Maintain evidence of the evaluation, decisions, actions, and current status.
38North helps you design the data, process, automation, and operating model required across all five stages.
Meeting VDR and VER requires more than updating policy language.
The process must work across your actual environment, tools, architecture, data, and teams. 38North combines FedRAMP advisory and cloud security engineering to help providers move from:
We help you design a process that fits how your cloud service actually operates—not a theoretical workflow that exists only on paper.
A readiness review may identify work that extends beyond policy and process. 38North's engineering team can help with:
You do not have to hand the roadmap to another team and start the explanation over again.
38North can help you move from assessment through implementation.
Talk to 38North →Yes. FedRAMP has announced that the rules will apply to all cloud service offerings obtaining or maintaining FedRAMP Certification, including existing Rev. 5 providers.
No. VDR was originally developed as part of the 20x model, but FedRAMP has accelerated mandatory adoption across FedRAMP-certified cloud services.
Scanning remains part of vulnerability detection, but FedRAMP has said that the legacy monthly scanning process followed by most Rev. 5 providers is insufficient.
Providers must be able to evaluate vulnerability context, make risk-based decisions, respond appropriately, and maintain meaningful reporting.
Vulnerability Evaluation and Reporting covers how vulnerabilities are evaluated and how the resulting information is reported.
Vulnerability Detection and Response covers the broader process of discovering vulnerabilities and supporting their ongoing mitigation and remediation.
The two rulesets work together.
Mitigation reduces the immediate risk while the vulnerability still exists. This may involve restricting access, blocking an attack path, isolating a component, or adding another protection.
Remediation removes the underlying vulnerability through actions such as patching, upgrading, changing code, or replacing the affected component.
FedRAMP has announced a corrective-action grace period through March 7, 2027. Providers relying on that period may maintain certification only under a corrective action plan, and their agency customers will be notified.
After the grace period, certifications that are not following the rules may be revoked.
FedRAMP has said minor changes may occur before the Consolidated Rules for 2026 are finalized. It has also explicitly told providers to familiarize themselves with the rules and begin preparing as quickly as possible.
No. 38North combines FedRAMP advisory with cloud security engineering. We can help assess readiness, design the operating model, and support the integrations, automation, and technical changes required for implementation.
Your team needs time to assess the current process, identify missing information, connect systems, clarify ownership, build automation, test the workflow, and operate it before the requirement becomes mandatory. Start by finding out where you stand.
Request a VDR & VER Readiness Review →Talk with 38North about your current FedRAMP program and the work required before December 7.