If you hold a FedRAMP certification, the nearest deadline on your calendar is December 7, 2026. FedRAMP's notice responding to CISA's BOD 26-04 puts it plainly: "The Vulnerability Detection and Response rules will be mandatory for all cloud service offerings obtaining or maintaining FedRAMP Certification effective December 7, 2026," with a grace period through March 7, 2027 for offerings operating under a corrective action plan.
It is also the deadline most programs have not fully scoped. The problem is not the date. It is that VDR and VER read like a scanning requirement and operate like something else entirely.
What the two rulesets actually change
Start with what is retired: the flat monthly-scan-and-POA&M model. Detection frequency is now set by certification class — under rule VDR-TFR-PSD, machine-based resources are scanned at least every 14 days at Class A, every 7 at Class B, every 3 at Class C, and at least once per day at Class D.
Machine verification and validation runs at least monthly for Rev5 holders, and as often as every three days at higher 20x classes.
Then the three provisions that reshape engineering work:
Remediation clocks are tiered and tight. Under VDR-TFR-PVR, fix deadlines are set by a vulnerability's PAIN rating and its exploitability, running from 192 days at the low end to 12 hours at the extreme — a Class D offering with a PAIN-5 vulnerability that is both likely exploited and immediately remotely exploitable.
A 12-hour clock is not a ticket-queue SLA. It is a paging and ownership question, and it has to hold on a holiday weekend.
The burden of proof inverted. VER-EVA-AIA — "Assume It's Automatable" — requires providers, in FedRAMP's words, "to assume exploits are automatable by default, unless they have evidence providing otherwise." Every deferral now needs a defensible artifact behind it, produced at volume, on the same clock as everything else.