# FedRAMP Puts BOD 26-04 Inside Every Cloud Offering on December 7

> FedRAMP's vulnerability rules become mandatory for every certified cloud offering on December 7, 2026, the same day agencies start working to CISA's BOD 26-04 timelines. Offerings that fall short go on corrective action plans with notice to all agencies, then lose certification after March 7, 2027.

- Source: https://avalontechservices.com/news/fedramp-puts-bod-26-04-inside-every-cloud-offering-on-december-7
- Published: 2026-10-29
- Author: [Brandon Ireland](https://avalontechservices.com/author/brandon-ireland)
- Category: Security Architecture & Implementation
- Topic: Security Architecture & Implementation
- Publisher: Avalon Technology Services

## Key Takeaways

- FedRAMP's VDR and VER rules become mandatory on December 7, 2026 for every certified cloud offering, the day civilian agencies start remediating on BOD 26-04 timelines.
- Rule VER-EVA-AIA makes providers assume exploitation can be automated unless they have evidence otherwise, shifting the burden of proof to the provider.
- Providers must report persistently, give agencies a human-readable report at least monthly, and rate each vulnerability's agency impact from N1 to N5.
- Through March 7, 2027, noncompliant offerings keep certification under a corrective action plan with notice to every agency; after that, certification is revoked.
- GAO-26-108443 found agencies fully performed continuous monitoring on three of eight cloud systems, so primes should name who reads the provider's monthly report.

On June 16, 2026, six days after CISA issued BOD 26-04, FedRAMP published [its response to the directive](https://www.fedramp.gov/notices/0014/). Its Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules become mandatory on December 7, 2026 for every cloud offering obtaining or maintaining FedRAMP certification. That is the same day civilian agencies must start remediating on the directive's timelines.

BOD 26-04 is a non-GAO directive that binds agencies, not vendors. FedRAMP's notice is how its clock reaches the cloud services those agencies run on. Any prime whose solution includes a FedRAMP offering, resold or operated, now has a December date in its delivery plan.

## Six Rules Map the Directive Into FedRAMP

The notice ties six rules to the directive. Together they turn its four decision points into provider obligations.

| Rule | What it requires |
| --- | --- |
| VER-EVA-EIR | Evaluate whether detected vulnerabilities are reachable from the internet |
| VER-EVA-ELX | Evaluate whether vulnerabilities are likely exploitable |
| VER-EVA-EFA | Weigh factors that supplement the directive's KEV status, exploit automation, and technical impact evaluation |
| VER-EVA-AIA | Assume exploitation can be automated unless there is evidence otherwise |
| VDR-TFR-KEV | Remediate known exploited vulnerabilities on the BOD 26-04 timelines |
| VDR-CSO-RES | Keep mitigating and remediating vulnerabilities on an ongoing basis |

The reach is broad. The [VDR rule set](https://www.fedramp.gov/2026/reference/vulnerability-detection-and-response/) applies to all providers with FedRAMP certifications of any type, under both the 20x and Rev5 frameworks.

## The Default Flips to "Automatable"

One rule matters more than its length suggests. VER-EVA-AIA says providers "MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise." Under the directive, automatability is one of the four factors that pushes a vulnerability toward the shorter windows. The burden of proof now sits with the provider.

Reporting changes shape too. Under the [VER rule set](https://www.fedramp.gov/2026/reference/vulnerability-evaluation-and-reporting/), providers must report detection and response activity "persistently, summarizing ALL activity since the previous report," and give all necessary parties a consistent, human-readable report at least monthly. Each vulnerability also gets a potential agency impact rating from N1, minimal effects on one agency, to N5, debilitating effects on multiple agencies.

For a provider used to a monthly scan and a plan of action, that means continuous evaluation, documented reasoning on reachability and exploitability, and a record agencies can read without asking for it.

## The Notice Every Agency Will See

The grace period is the part capture teams should plan around. Through March 7, 2027, an offering that does not yet follow the rules can keep its certification under a corrective action plan, and that plan includes notice to all agencies. After March 7, FedRAMP says certification will be revoked for offerings not following the rules.

Two things follow for a prime. First, an agency evaluating a proposal in the first quarter of 2027 may already have a corrective action notice for a cloud service named in the solution. Second, a solution built on an offering that misses the March date has a certification problem in the middle of performance, which is the kind of risk an evaluator scores.

Agencies have their own reason to care. For the cloud services they use, the provider's reporting under these rules is much of the evidence they will have.

## Agencies Already Struggle to Watch Their Providers

GAO has already documented the oversight gap these rules land on. In June 2026, it reviewed eight cloud systems at State, Transportation, VA, and SBA and found that [agencies fully performed continuous monitoring for three of the eight](https://www.gao.gov/products/gao-26-108443). Service level agreements fared better, fully implemented for five of eight. GAO made 12 recommendations to State, VA, and SBA, covering continuous monitoring, incident response, recovery, and how service level agreements are defined.

That is the gap a persistent, human-readable provider report is supposed to fill. It only helps if someone on the agency side, or on the prime's team, reads it and acts on what it says. A capture plan that names who receives the provider's monthly report, and who follows up on it, answers a question GAO has already shown agencies struggle with.

## Diligence to Do Before December

If a cloud offering is part of your solution, these are worth confirming with the provider now, in writing:

- Whether it plans to follow the VDR and VER rules by December 7, or expects to operate under a corrective action plan.
- How it evaluates internet reachability and exploitability, and what evidence it keeps when it overrides the "automatable" default.
- What its monthly human-readable report looks like, and whether your agency customer will receive it directly.
- Who remediates components your team operates inside the offering's boundary, and on which clock.

The last item is where teaming arrangements get tested. A prime that operates workloads on a certified platform can end up holding [part of the remediation on the platform's timeline](https://avalontechservices.com/capabilities/cybersecurity/security-architecture-and-implementation/remediation-and-patch-management), with no emergency lane in its own staffing plan.

## Where a Remediation Sub Fits

The paired Technical Brief, [BOD 26-04: What the Three-Day Patch Window Means by December 7](https://avalontechservices.com/technical-briefs/bod-26-04-what-the-three-day-patch-window-means-by-december-7), covers the agency side: clock assignment, tested waves, the emergency lane, triage coordination, and closure evidence. Avalon's [Remediation & Patch Management white paper](https://avalontechservices.com/white-papers/remediation-and-patch-management) lists FedRAMP among the frameworks the service supports, with remediation operations aligned to the new vulnerability rules where agencies or providers need them.

If your solution puts a FedRAMP offering in front of a civilian agency, Avalon teams as the sub that runs the remediation lane on the BOD 26-04 clocks and produces the closure evidence both the provider's reports and the agency's compliance depend on.