-1.jpg?width=300&name=Stephen%20VanHorn%20(1)-1.jpg)
What is vulnerability management? Vulnerability management is the continual assessment and remediation of vulnerabilities and threats within a system. The cycle has five steps: discovery, assessment, prioritization, remediation, and monitoring. A vulnerability assessment is a point-in-time look at what is weak. Vulnerability management is the program that finds, ranks, fixes, and rechecks those weaknesses on a continuing basis.
2026 update: For FedRAMP providers the cycle is now a rule. FedRAMP made VDR (Vulnerability Detection and Response) and VER (Vulnerability Evaluation and Reporting) mandatory on December 7, 2026 for all offerings obtaining or maintaining FedRAMP Certification, with a grace period to March 7, 2027.
Jump to: The five-step cycle · VDR and VER (December 7, 2026) · VDR & VER requirements · Quzara vulnerability management
Why vulnerability management matters
Unchecked security vulnerabilities can lead to cybersecurity attacks that threaten the systems of your organization. Depending on the network compromised, the consequences of such an attack can range from loss of reputation to significant financial or legal damages, all the way to national security threats.
Quzara has helped secure systems that fall under each of these categories. In this post, we discuss what vulnerability management is and what the process looks like, and then how federal programs, including FedRAMP, turn the same cycle into requirements.
Vulnerability, risk, and threat
When learning about cybersecurity, you will likely come across the terms vulnerability, risk, and threat. These three terms are related but distinct concepts within the cybersecurity field. Understanding the difference is important to understanding the vulnerability management process.
Vulnerability
A weakness in a system that could be exploited by an attacker and used to gain unauthorized access or otherwise compromise the security of the system. Vulnerabilities can be found in hardware, software, networks, or some other component of the system. Configuration errors, programming mistakes, or design flaws cause them.
Risk
The likelihood of a given vulnerability being exploited, and an evaluation of the impact it would have if such an exploit were to occur. In evaluating risk, cybersecurity professionals consider the severity of the vulnerability, the probability of an attack that will exploit it, and the consequences of a successful attack.
Threat
A potential event that could result in a vulnerability being exploited and causing harm to a system or the business it belongs to. Threats can be intentional and malicious, such as a cyberattack, or unintentional, such as a natural disaster or human error.
In plain terms: A vulnerability is the weakness, a threat is what could exploit it, and risk is how likely and how damaging that exploitation would be.
Vulnerability management versus a vulnerability assessment
We now know what a vulnerability is, so what is vulnerability management? Vulnerability management differs from the related term, vulnerability assessment.
| Vulnerability assessment | Vulnerability management | |
|---|---|---|
| Timing | A point-in-time look at a system's vulnerabilities. | Continual. Because new cybersecurity threats are always emerging, the process repeats itself. |
| Goal | Discover all of the vulnerabilities that exist in a system at that moment. | Take the list from the assessment, develop a risk profile for each item, and address those risks. |
| Method | Automated scans that look for known vulnerabilities, or manual means if the situation warrants it. | Patching software with the latest security updates, changing configuration files to align with cybersecurity best practices, and more. |
| Typical findings | Outdated software, misconfigured networks, and other factors that increase the chance of an attacker gaining access. | A prioritized backlog, remediation work, and a recheck that the fixes held. |
Broadly speaking, a vulnerability assessment is an early step in the vulnerability and threat management process. After the assessment is over, the vulnerability management process can begin in full.
Definition: A good vulnerability management definition is "the continual assessment and remediation of vulnerabilities and threats within a system."
The five steps of the cycle
The vulnerability management cycle has five steps, and the last one feeds the first.
- Discovery. The first step is to discover all aspects of the system that need to go through the vulnerability assessment process. This may include network devices, servers, applications, and databases.
- Assessment. Perform an assessment to identify vulnerabilities that exist on each of the identified items. This is done using automated scanning tools that identify potential weaknesses in the system.
- Prioritization. Once vulnerabilities have been identified, they are prioritized based on a risk evaluation. This includes assessing the likelihood of the vulnerability being exploited and the potential impact of exploitation.
- Remediation. Remediate the identified vulnerabilities. This may include patching systems, updating configurations, or implementing compensating controls.
- Monitoring. Monitor the effectiveness of the remediation efforts. This involves monitoring for new vulnerabilities and ensuring that all previously identified vulnerabilities have been successfully addressed.
How federal programs map the cycle to NIST SP 800-53
Federal programs do not use a different cycle. They require the same work and ask you to show it. On the FedRAMP Rev5 path, vulnerability work maps to NIST SP 800-53 Rev 5 controls, and continuous monitoring is how the evidence stays current between assessments.
| Cycle step | What it looks like in a federal program | Typical NIST SP 800-53 Rev 5 controls |
|---|---|---|
| Discovery | A current inventory of the components in the boundary, and a scanning scope that covers them. | CM-8 System Component Inventory, RA-5 Vulnerability Monitoring and Scanning |
| Assessment | Scheduled and event-driven scanning, plus other detection methods. | RA-5 Vulnerability Monitoring and Scanning |
| Prioritization | A documented risk evaluation that ranks findings by exploitability and impact. | RA-3 Risk Assessment |
| Remediation | Patches, configuration changes, or compensating controls, tracked against deadlines. | SI-2 Flaw Remediation |
| Monitoring | Ongoing monitoring and reporting to the people who rely on the system's security posture. | CA-7 Continuous Monitoring, RA-5 |
This table is Quzara's summary of the usual mapping, not a table published by FedRAMP. Your own control implementation statements and your assessor decide what applies to your boundary. The CISA Known Exploited Vulnerabilities (KEV) catalog adds a federal remediation deadline for vulnerabilities attackers are already using, and FedRAMP's rules now refer to it directly.
What VDR and VER change on December 7, 2026
FedRAMP made the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets mandatory in Notice NTC-0014, published June 16, 2026, in alignment with CISA Binding Operational Directive 26-04. They are mandatory on December 7, 2026 for all cloud service offerings obtaining or maintaining FedRAMP Certification. Offerings can stay certified under a corrective action plan through March 7, 2027, and after that date FedRAMP will revoke certification for offerings not following the rules. (Rev5 deadlines)
Dates: Optional adoption opened July 4, 2026. VDR and VER are required to obtain and to maintain certification from December 7, 2026. The grace period ends March 7, 2027. Quzara does not promise a certification date, and neither does FedRAMP.
How the five steps line up with VDR and VER
| Cycle step | What the FedRAMP rules ask for | Ruleset |
|---|---|---|
| Discovery | Find vulnerabilities across the whole cloud service offering using methods such as scanning, penetration testing, threat intelligence, bug bounties, and automated control testing. Detection is not limited to CVEs. An out-of-date control statement in the Security Decision Record counts. | VDR |
| Assessment | Evaluate whether each vulnerability is internet-reachable and likely exploitable. Assume exploitation can be automated unless you have evidence showing otherwise. | VER |
| Prioritization | Weigh eight factors (criticality, reachability, exploitability, detectability, prevalence, privilege, proximate vulnerabilities, and known threats) and estimate the potential impact on government customers on an N0 to N5 scale. | VER |
| Remediation | Remediate Known Exploited Vulnerabilities by the due dates in the CISA catalog. Mitigate or remediate others within windows that depend on certification class and on reachability and exploitability. A vulnerability not fully mitigated or remediated within 192 days of evaluation must be categorized as accepted. | VDR and VER |
| Monitoring | Report detection and response activity persistently, with a human-readable report at least monthly. Reports are certification data subject to the data-sharing rules. | VER |
Detection frequencies and response windows differ by class (A through D) and, for some items, by whether the offering is on the 20x or Rev5 path, so read the rulesets for your class before you set a program calendar: VDR ruleset and VER ruleset. Quzara's VDR and VER requirements guide and FedRAMP VDR and VER requirements for 2026 go through them in detail.
Vulnerability management solutions
Cybersecurity is too important to take lightly. Quzara operates a FedRAMP Certified Class D (High) managed detection and response platform and supports systems from the network at a small business to the infrastructure of a government agency or contractor.
Quzara vulnerability management
Discovery, prioritization, and remediation tracking as a managed service. Start with the vulnerability management service page.
Cybertorch
Cybertorch runs 24/7 security operations on Azure Government with U.S. citizen analysts, as a FedRAMP Certified Class D platform, so detection and response work does not rest on your own SOC build.
NISTcompliance.ai
NISTcompliance.ai keeps findings and remediation status tied to your controls, so the evidence for VDR, VER, and continuous monitoring comes from the same record.
To learn more about how Quzara can keep your systems secure, contact us today.
Frequently asked questions
What is vulnerability management?
The continual assessment and remediation of vulnerabilities and threats within a system. It runs as a five-step cycle: discovery, assessment, prioritization, remediation, and monitoring.
How is vulnerability management different from a vulnerability assessment?
A vulnerability assessment is a point-in-time look at a system's vulnerabilities. Vulnerability management builds on it with risk profiles, remediation, and repeated reassessment.
Does FedRAMP require vulnerability management?
Yes. FedRAMP's VDR and VER rulesets are mandatory for all offerings obtaining or maintaining FedRAMP Certification from December 7, 2026, with a grace period to March 7, 2027 under a corrective action plan. VDR and VER requirements.
Is a CVE the only kind of vulnerability FedRAMP counts?
No. Under VDR, detection is not limited to CVEs. An out-of-date control statement in the Security Decision Record counts as a vulnerability, and so do failures in the detection and response processes themselves.
What does the 192 day threshold mean?
Under VER, a vulnerability that is not fully mitigated or remediated within 192 days of evaluation must be categorized as an accepted vulnerability, which carries its own required data items, including the reason for acceptance.
Which NIST SP 800-53 controls cover vulnerability management?
On the Rev5 path the usual ones are RA-3 Risk Assessment, RA-5 Vulnerability Monitoring and Scanning, SI-2 Flaw Remediation, CM-8 System Component Inventory, and CA-7 Continuous Monitoring. Your assessor decides what applies to your boundary.
Sources and verification
The FedRAMP dates and rule descriptions in this post were checked against the primary sources below on October 14, 2026. Confirm them before you plan.
- Notice NTC-0014 and Rev5 deadlines
- VDR ruleset and VER ruleset
- CISA Binding Operational Directive 26-04
- NIST SP 800-53 Rev 5
Featured Image: Stephen VanHorn / Shutterstock
Talk to Quzara About Vulnerability Management
Build the cycle once, and meet VDR and VER from the same record.
Schedule a Consultation