VDR/VER migration progress reporting Q&A/feedback/etc.

[pete-gov]

VDR/VER Migration Reporting Q&A / General Discussion

On Tue Nov 10, 2026, FedRAMP released Public Notice NTC-0017 VDR/VER Migration Progress Reporting and Upcoming FY27 Q1 FedRAMP Security Inbox Test.

This Notice explained that FedRAMP will be collecting Progress Reports from all FedRAMP Certified cloud service providers who are expected to migrate to the VDR/VER rules and explained how that information will be collected.

It included the VDR/VER Migration Resources website for additional information on Progress Report collection, including deadlines, corrective action plans, schemas, and more.

---

Collecting progress reports from nearly 600 cloud services is obviously a massive undertaking. We weren't even sure if it was feasible, to be honest. This is partially a test to see how it goes. In the future when folks have adopted CR26 or future consolidated rules things will be much easier as we can simply programmatically monitor everyone's information but today we still need to ask for progress reports.

This thread is dedicated to questions or feedback about this process, including the content, instructions, schemas, etc.

[iteuscher]

We noticed that VDR-TFR-MVF is included as required on the mini-SDR schema but the requirement seems only applicable to Rev5 CSPs not 20x CSPs.

Persistent Machine Verification and Validation for Rev5
VDR-TFR-MVF
Providers of FedRAMP Rev5 Class B/C/D offerings SHOULD/MUST verify and validate the status of machine-based information resources at least once every month.

Should 20x CSPs include VDR-TFR-MVF as Not Applicable in their mini-SDR or leave it out?

Thanks,
Isaac & Paramify Team