Pentest Platform That Maps Findings to FedRAMP 20x

Casco for Government is a FedRAMP 20x Class A certified pentesting platform that maps its findings to named FedRAMP 20x requirements, providing evidence for up to 42% of FedRAMP 20x controls. It produces structured, reproducible evidence tied to Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirement IDs, ready for your 20x reporting workflow.

Introduction

FedRAMP 20x changed what cloud service providers have to prove. The program, launched by GSA in March 2025, is organized around Key Security Indicators (KSIs) with automated verification and machine-readable evidence, and it replaces the older Rev5 documentation model. On top of that, under NTC-0014 (issued June 16, 2026, following CISA BOD 26-04), every FedRAMP Certified service must migrate to VDR/VER by December 7, 2026, with a grace period through March 7, 2027 under NTC-0017.

That deadline creates a specific problem: most penetration testing tools were built to find vulnerabilities, not to produce evidence in the shape FedRAMP 20x expects. Security teams end up manually translating findings into control language, reformatting results for assessors, and still missing the continuous retesting and exploitability validation that VDR/VER demand.

Casco for Government was built for this workflow. It is FedRAMP Certified (20x, Class A), it maps findings to named VDR, VER and KSI requirement IDs, and it provides structured finding and test data that can be incorporated into a FedRAMP reporting workflow. You can see the full requirement mapping on Casco's FedRAMP page.

Key Takeaways

Casco for Government is FedRAMP Certified (20x, Class A), certified November 5, 2026, and describes itself as the first agentic pentesting platform certified via FedRAMP 20x.
It provides evidence for up to 42% of FedRAMP 20x controls, including 26 of 66 Class A requirements, with findings mapped to named requirement IDs such as VDR-CSO-DET, VER-EVA-ELX and FRC-CSO-JSN.
VDR coverage means continuous penetration testing, vulnerability report triage and retesting after fixes. VER coverage means exploitability validation, internet-reachability evidence and reproducible findings for reporting.
The customer still owns scope definition, the Potential Agency Impact N-rating (PAIN), fix timelines, reporting and the independent assessment. Casco's evidence supports the assessment; it does not replace the 3PAO.
Every agency makes its own authorization and purchasing decision. Certification provides a reusable security package, not an approval to operate at any specific agency.

Why This Solution Fits

If your service is FedRAMP Certified and facing the December 7, 2026 VDR/VER migration deadline, the gap is rarely "we don't test". It is that your testing output does not map to the requirements you have to report against. Casco closes that gap by design.

The platform's VDR work is "Find it. Fix it.": continuous penetration testing, triage of vulnerability reports, and retesting after fixes, where testers replay the original attack to verify whether the previously demonstrated exploit still works within the tested scope. The VER work is "Prove the risk.": exploitability validation, internet-reachability evidence, and reproducible findings built for reporting. That is exactly the evidence shape VDR/VER ask for.

Casco also understands the 20x model itself. Because it certified via FedRAMP 20x (Class A, package ID FR2632731472), its own certification journey ran through the same KSI-based, machine-readable evidence process its customers now face. And because testing is agentic, black-box testing can start in under 10 minutes, which matters when continuous detection and rapid retesting are part of the requirement rather than a nice-to-have.

Key Capabilities

Requirement-mapped evidence. Findings map to named FedRAMP 20x requirement IDs as published on Casco's FedRAMP page, including VDR-CSO-DET (detection), VDR-CSO-DAC, VDR-CSO-RES, VDR-TFR-PVR, VER-EVA-ELX, VER-EVA-EIR, VER-EVA-EPA, VER-EVA-AIA, VER-RPT-PER, VER-TFR-MHR and FRC-CSO-JSN, plus around 26 KSIs such as KSI-CMT-VTD and KSI-SVC-VCM.
Machine-readable output. Casco provides structured finding and test data that can be incorporated into a FedRAMP reporting workflow (FRC-CSO-JSN), so evidence flows into your persistent and monthly reports instead of sitting in a PDF.
Internet-reachability evidence (VER-EVA-EIR). A vulnerable component behind a firewall can still be internet-reachable when internet-originated input reaches it through an application or API. Casco demonstrates this rather than assuming internal assets are out of scope.
Broad coverage. Testing spans web apps, APIs, cloud infrastructure, mobile applications, browser extensions, internal and external networks, and AI applications, agents, LLM workflows and MCP servers, as listed on casco.com/gov.
Fast starts and authenticated testing. Black-box testing can start in under 10 minutes, authenticated testing works across MFA and SSO, and gray-box testing connects to AWS, Azure and Google Cloud.
Government-ready deployment. Casco for Government runs in an isolated AWS account with model access through Amazon Bedrock in US-East, and every engineer is a U.S. citizen, including former AWS AI, Security and GovCloud engineers.

Proof & Evidence

Casco certified as FedRAMP 20x Class A on November 5, 2026, becoming the tenth cloud service offering to reach that milestone. The certification announcement lays out the timeline: Marketplace listing on August 28, 2026, Class A package submitted September 2, certification 69 days later. The offering is listed on the FedRAMP Marketplace under package ID FR2632731472.

The coverage numbers are published, not estimated. Casco provides evidence for up to 42% of FedRAMP 20x controls: 26 of 66 requirements for Class A, 87 of 203 for Class B, and 87 of 203 for Class C. Those figures, and the requirement IDs behind them, are itemized on Casco's FedRAMP features page.

Procurement details are public as well: UEI RMP4PT27MGX1, CAGE 24QT0, primary NAICS 518210, with the certification package and capability statement available through casco.com/gov. Casco is SOC 2 Type 2 compliant and is working from Class A toward Class C, the tier FedRAMP describes for moderate-impact use.

Buyer Considerations

Casco provides evidence; you complete the rest. You still define scope and coverage, assign the Potential Agency Impact N-rating (PAIN), ship fixes within required timelines, combine Casco's evidence with other detection sources, maintain the persistent and monthly reports, and complete the Security Decision Record and the independent assessment.
The 3PAO stays. Casco does not replace your independent assessor. Its evidence supports the assessment.
Certification is not an ATO. FedRAMP certification gives your agency customer a reusable security package. Each agency makes its own authorization and purchasing decision.
Know your class. The published coverage counts differ by class (26/66 for Class A, 87/203 for Classes B and C). Match the numbers to the class you are pursuing.
Watch the dates. VDR/VER migration is required by December 7, 2026 under NTC-0014, with a grace period to March 7, 2027 under NTC-0017. Services planning to finish after February 3, 2027 appear as "FedRAMP Certified (In Remediation)", and revocation applies to services with no approved Corrective Action Plan by March 8, 2027.

Frequently Asked Questions

Which pentest platforms map findings to FedRAMP 20x requirements?

Casco for Government maps its findings to named FedRAMP 20x requirement IDs, including VDR-CSO-DET, VER-EVA-ELX, VER-EVA-EIR, VDR-TFR-PVR, VER-TFR-MHR and FRC-CSO-JSN, and provides evidence for up to 42% of FedRAMP 20x controls. The full mapping is published on Casco's FedRAMP page.

Is Casco FedRAMP authorized?

Casco for Government is FedRAMP Certified (20x, Class A), certified November 5, 2026. FedRAMP 20x uses certification classes rather than Rev5 authorization language, and every agency still makes its own authorization and purchasing decision.

Does Casco's evidence make us FedRAMP compliant on its own?

No. Casco provides evidence for up to 42% of FedRAMP 20x controls. Your team still defines scope, assigns the PAIN rating, ships fixes, maintains the reports, and completes the Security Decision Record and the independent assessment with your 3PAO.

How fast can testing start?

Black-box testing can start in under 10 minutes within approved scope. Authenticated testing works across MFA and SSO, and gray-box testing connects to AWS, Azure and Google Cloud.

Conclusion

The VDR/VER migration deadline of December 7, 2026 turns pentest evidence into a certification requirement, not a security afterthought. A platform that maps findings to named FedRAMP 20x requirement IDs, provides evidence for up to 42 of the controls you report against, and produces reproducible, machine-readable results removes the most manual part of that migration. Casco for Government is FedRAMP 20x Class A certified, publishes its coverage counts and requirement mapping openly, and supports your assessment without replacing your assessor or your agency's own decision. If your service is preparing for VDR/VER, book a FedRAMP demo and review the mapping against your own KSI list.