FedRAMP’s New Vulnerability Detection and Response Standard

WOW! If you haven’t heard, FedRAMP released a new Vulnerability Detection and Response (VDR) standard on September 11, 2025. This new standard is poised to really change the way Cloud Service Providers (CSP) deliver continuous monitoring to their agencies.  

Who does this Impact? 

If you are currently FedRAMP authorized on Revision 5, there is no short-term impact unless you volunteer to be a part of the Rev5 VDR Open Beta that is tentatively scheduled for release on October 15,2026.

On the other hand, if you are FedRAMP 20x Low authorized, you should already be starting to apply this standard effective September 15, 2025.  CSP’s in this space are required to demonstrate significant progress in implementing this quarterly with full adoption one year from authorization.

What are the changes? 

This is a complex question. FedRAMP is looking to modernize the way CSP’s identify, assess, and remediate vulnerabilities. In doing so, FedRAMP is looking to evaluate the risk of vulnerabilities outside of the traditional CVSS v3 scoring.  The risk evaluation is based on an assessment of the likelihood of exploitability (LEV). This allows the CSP to apply logic to determine Environmental Exploitability, Internet Exposure, Privilege Escalation, Criticality, Prevalence, Proximate Vulnerabilities, and Known Threats.  Through this logic, a new risk rating system emerged where vulnerabilities are categorized from N1 (negligible) to N5 (Catastrophic).

With new risk categories, new remediation timelines are introduced based on the CSP FedRAMP authorization level (Low, Moderate, High). Below is a breakdown of the new remediation timelines where CSP’s should partially mitigate, fully mitigate, or remediate to a lower risk rating.