VDR/VER Is Almost Here. What CSPs Should Be Doing Now.

The first near-term ask: be ready to respond

The update says FedRAMP expects to send an Emergency Test notification to all CSPs in early December. Providers should be ready to provide a “mini-SDR” describing their implementation of each VDR/VER rule and provide sample vulnerability reports. The response deadline is expected to be December 17. The update also warns that not responding may lead to administrative action under FedRAMP’s communication rules.

That is a short runway. Don’t wait for the notification to decide who owns the response or where the evidence lives.

The update also says FedRAMP expects to publish a Public Notice and launch a website no later than November 10. The site is expected to grow over time with implementation guidance, FAQs, examples, and supporting tools. Templates, schemas, validators, and web viewers are planned.

A few details are worth getting right now. The “mini-SDR” is expected in CSV or JSON—not XLSX. The CAP template is expected in Markdown—not DOCX. Both are intended for text-based editing: you can edit them directly or use a document-management tool, then export as text and validate. There will not be an extra template for vulnerability reports; CSPs are responsible for preparing those.

This is broader than scanning

A scan can be one part of the story, but CSPs need to be ready to explain how the whole process works: what is in scope, how weaknesses are found, how findings are evaluated, who makes response decisions, how remediation is tracked, and how activity is reported.

That includes knowing how the process covers the authorized boundary and how the evidence connects back to the systems that operate the service. If you have multiple tools or teams involved, make sure the handoffs are clear. A set of good tools does not automatically add up to a working process.

The dates matter—and they are not all the same date

The VDR/VER effective date is December 7, 2026. The update materials then describe an Emergency Test response expected by December 17, followed by a staged approach for providers that are not yet fully implemented.

Based on the update:

• After December 17, a CSP that has not fully implemented VDR/VER and has no Corrective Action Plan (CAP)—or has a CAP with a target completion date after February 3, 2027—may be designated as “FedRAMP Certified (In Remediation) in the marketplace.”
• After February 3, providers are expected to have a CAP formally approved by FedRAMP. The slides say a CAP may be denied if the provider is not responsive, proposes a VDR/VER completion date after the March 7 grace period without agreeing to a FedRAMP red-team assessment, or does not meet the stated conditions.
• March 7, 2027 is the end of the described grace period. The slides outline potential certification revocation and a one-year ban from FedRAMP for providers that have not implemented the requirements and also fail the specified CAP, red-team, progress, or communication conditions.

The examples FedRAMP plans to publish are AI-generated and have received only a cursory review. They are meant to show the level of information that may be acceptable—not to create new rules or prescribe wording. Use them as examples, then apply the actual requirements to your service.

These are meaningful consequences, but they are not a reason to guess at your status or assume the grace period solves the problem. Confirm which requirements apply to your offering, document what is in place, and be clear about what remains.

Good faith matters. So does a credible plan.

The message in the update is not that FedRAMP wants providers to fail this transition. It says that providers working in good faith to adopt the rules, without egregious security issues, will not lose certification simply for being in transition.

That should be reassuring—but it is not a blanket exemption. “We are working on it” is not a plan. If you still have gaps, be prepared to explain the gap, the owner, the action underway, the target date, and how you are managing risk in the meantime. Be responsive, and keep evidence of progress.

Keep your agency customers in view, too. FedRAMP’s examples may show what is acceptable for a general government-wide use case, but an agency may ask for more. Don’t respond with “FedRAMP said this was all we had to do.” Listen to the customer’s concern and show how seriously you are treating it.

What I would do this week

• Name one accountable owner for the response and confirm the supporting security, engineering, compliance, and leadership contacts.
• Map each applicable VDR/VER rule to the process, evidence, and person who can explain it.
• Pull representative vulnerability reports and check that they tell a consistent story from detection through evaluation, response, and reporting. You will need to develop your own report format.
• Use the examples to calibrate the level of detail, not as substitute rules or text to copy.
• Prepare the mini-SDR in CSV or JSON and the CAP in Markdown, as specified in the update.
• Identify what is not yet in place. Put owners and realistic dates against those gaps, and determine whether a CAP is needed.
• Rehearse the Emergency Test response. Make sure the person submitting it can find the evidence and answer follow-up questions.

No one should be trying to build this operating model in the last few days before the deadline. And no one should assume that a good-faith statement, by itself, will answer the questions FedRAMP is asking.

The practical goal is straightforward: know where you stand, show your work, and communicate early. The providers who can do that will be in a much better position to manage this transition.

Want a clearer path from requirements to action? Join us November 19 for Get Ahead of VDR/VER: What FedRAMP Organizations Need to Do Now. We’ll break down what VDR/VER requires, what the December 7 and March 7 milestones mean, and how to build a practical adoption plan. The live webinar runs from 12:00 to 1:00 p.m. ET and is eligible for one CPE credit.