Vulnerability Management (VDR/VER)
FedRAMP 20x Vulnerability Detection and Response uses machine-readable VER reports and published remediation timeframes. Detection is ongoing. A finding without a PAIN evaluation has no deadline — it is unevaluated, not silently due tomorrow.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Pinned schemas are dated 2026-06-24. Report kinds: VER-RPT-VDT (FedRAMP Vulnerability Detail Report (VER-RPT-VDT)); VER-RPT-AVI (FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)); VER-TFR-MRH (FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)). VDR-TFR-PVR timeframes run from evaluation by Potential Agency Impact (PAIN) and exposure (LEV+IRV, LEV+NIRV, NLEV). Class C machine-resource verification is at least every 3 days (VDR-TFR-MVX).
How to implement
Emit VER-RPT-VDT for non-accepted activity, VER-RPT-AVI for accepted vulnerabilities, and VER-TFR-MRH for historical activity. Validate with ver-validate.ts. Do not invent a PAIN rating. Connectors only see resources the customer connected; 3-day verification is not a scan of unconnected machines.
Evidence expectations
Each reported vulnerability names the resource, evaluation time, and PAIN/exposure when evaluated. Synthetic examples on this page use no customer data.
Common mistakes
- Starting the VDR clock from discovery instead of evaluation. - Assigning a PAIN rating when none was recorded. - Treating connector sync age as a full-fleet machine scan. - Mixing Rev5 date-of-discovery SLAs (30/90/180) with VDR-TFR-PVR days.
VER report kinds (schema 2026-06-24)
| Code | Title | Required properties |
|---|---|---|
| VER-RPT-VDT | FedRAMP Vulnerability Detail Report (VER-RPT-VDT) | certificationPackageOverviewUri, reportPeriod, vulnerabilities |
| VER-RPT-AVI | FedRAMP Accepted Vulnerability Info (VER-RPT-AVI) | certificationPackageOverviewUri, reportPeriod, acceptedVulnerabilities |
| VER-TFR-MRH | FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH) | certificationPackageOverviewUri, generatedAt, activeVulnerabilities, acceptedVulnerabilities |
VDR-TFR-PVR days from evaluation
Class C SHOULD. Clock starts at evaluation. Unevaluated findings have no deadline.
| PAIN | LEV+IRV | LEV+NIRV | NLEV |
|---|---|---|---|
| PAIN-5 | 2d | 4d | 16d |
| PAIN-4 | 4d | 8d | 64d |
| PAIN-3 | 16d | 32d | 128d |
| PAIN-2 | 48d | 128d | 192d |
Questions teams ask
- When does the VDR-TFR-PVR clock start?
- From evaluation of PAIN and exposure, not from first discovery and not from 'now' at report generation.
- What if PAIN is missing?
- The finding is unevaluated. scm.cc does not fabricate a rating or a deadline.
- Is the 3-day rule the same as the PAIN table?
- No. The 3-day rule is Class C machine-resource verification (VDR-TFR-MVX). PAIN days are separate remediation timeframes.
Related hub pages
Primary sources
- Vulnerability Detection and Response (VDR/VER) (retrieved 2026-09-27)
- Collaborative Continuous Monitoring (CCM / Ongoing Certification Report) (retrieved 2026-09-27)
- FedRAMP Certification reference (classes, KSI metrics window) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.