Security Testing That Produces FedRAMP 20x Evidence

Casco for Government is the security testing platform built for the FedRAMP 20x shift, providing evidence for up to 42% of FedRAMP 20x controls, including the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements. Its continuous, reproducible findings map to named requirements your assessors and agency reviewers expect.

Introduction

FedRAMP 20x replaced the Rev5 documentation exercise with something more demanding in a different way: continuous, machine-readable evidence tied to Key Security Indicators. Under notice NTC-0014 (June 16, 2026, issued in response to CISA BOD 26-04), every FedRAMP Certified service must migrate to VDR/VER by December 7, 2026. Notice NTC-0017 (November 10, 2026) added progress reporting and a grace period through March 7, 2027, after which services without an approved Corrective Action Plan risk revocation.

That deadline changes what you should ask of a security testing vendor. A penetration test that ends in a PDF does not map cleanly to VDR/VER, which expects continuous detection, triage, retesting after fixes, exploitability validation, and reproducible findings you can incorporate into a FedRAMP reporting workflow. Casco for Government is FedRAMP 20x Class A certified and maps its testing output to named VDR/VER requirements, so the evidence your assessor needs comes from the testing you were going to run anyway.

Key Takeaways

The Rev5 to 20x migration is on a clock: VDR/VER migration is required by December 7, 2026, with a grace period through March 7, 2027 under NTC-0017.
20x evidence is continuous and machine-readable, so a one-time annual pentest report does not satisfy what VDR/VER asks for.
Casco for Government is FedRAMP 20x Class A certified and provides evidence for up to 42% of FedRAMP 20x controls (26 of 66 for Class A).
Casco maps its findings to named requirements such as VDR-CSO-DET, VER-EVA-ELX, VER-EVA-EIR, and FRC-CSO-JSN, so evidence slots into your reporting workflow.
Certification does not decide anything for you: each agency still makes its own authorization and purchasing decision, and you still own scope, PAIN ratings, fixes, reports, and the independent assessment.

Why This Solution Fits

The 20x model is organized around Key Security Indicators with automated verification and machine-readable evidence, a deliberate break from Rev5's NIST SP 800-53 documentation approach. When you evaluate testing support for that model, three things matter.

First, the vendor's own certification. Casco for Government is FedRAMP Certified (20x, Class A), certified on November 5, 2026, and listed on the FedRAMP Marketplace. Casco describes itself as the first agentic pentesting platform certified via FedRAMP 20x. Working with a certified offering gives your assessors and agency reviewers a standardized, reusable security package to draw on, though your agency always makes its own authorization decision.

Second, evidence coverage that maps to the actual requirements. Casco provides evidence for up to 42% of FedRAMP 20x controls: 26 of 66 for Class A, 87 of 203 for Class B, and 87 of 203 for Class C. The coverage page names the requirement IDs, including VDR-CSO-DET for continuous detection, VER-EVA-ELX for exploitability validation, VER-EVA-EIR for internet-reachability evidence, and FRC-CSO-JSN for structured finding and test data that can be incorporated into a FedRAMP reporting workflow.

Third, testing that runs continuously rather than annually. VDR is "Find it. Fix it.": continuous penetration testing, vulnerability report triage, and retesting after fixes. VER is "Prove the risk.": exploitability validation, internet-reachability evidence, and reproducible findings for reporting. Casco's black-box testing can start in under 10 minutes, with authenticated testing across MFA and SSO and gray-box connections to AWS, Azure, and Google Cloud.

Key Capabilities

Continuous penetration testing (VDR). Ongoing testing against pre-approved targets, with vulnerability report triage and retesting after fixes. A retest replays the original attack to show whether the previously demonstrated exploit still works within the tested scope.
Exploitability validation (VER). Casco reproduces or demonstrates exploits rather than just listing scanner findings, and VER requires providers to assume exploitation can be automated unless evidence shows otherwise.
Internet-reachability evidence (VER-EVA-EIR). A vulnerable component behind a firewall can still be internet-reachable when application or API input reaches it. Casco produces evidence that captures this, instead of treating internal assets as out of scope by default.
Machine-readable findings (FRC-CSO-JSN). Structured finding and test data that can be incorporated into a FedRAMP reporting workflow, supporting the 20x emphasis on automated verification.
Broad coverage. Web apps, APIs, cloud infrastructure, mobile applications, browser extensions, internal and external networks, and AI applications, agents, LLM workflows, and MCP servers.

Proof & Evidence

Casco became the tenth cloud service offering to achieve FedRAMP 20x Class A certification, on November 5, 2026, 69 days after its Marketplace listing. The certification announcement covers the timeline, and the FedRAMP feature page publishes the per-class coverage counts and the named requirement IDs behind the "up to 42%" headline.

The certification package and capability statement are available through the Trust Center and casco.com/gov, along with procurement details (UEI RMP4PT27MGX1, CAGE 24QT0). The government offering runs in an isolated AWS account with model access through Amazon Bedrock in US-East, every engineer is a U.S. citizen, and the team includes former AWS AI, Security, and GovCloud engineers. Casco is working from Class A toward Class C, the tier FedRAMP describes for moderate-impact use.

Buyer Considerations

Casco provides evidence; it does not complete the migration for you. Under the shared-responsibility model on the FedRAMP feature page, you still:

define scope and coverage;
assign the Potential Agency Impact N-rating (PAIN);
ship fixes within the required timelines;
combine Casco's evidence with your other detection sources;
maintain the persistent and monthly reports;
complete the Security Decision Record and the independent assessment.

Casco does not replace your 3PAO. Its evidence supports the independent assessment rather than substituting for it. Also keep the dates in view: services planning to complete the migration after February 3, 2027 are shown as "FedRAMP Certified (In Remediation)", and a service with no approved Corrective Action Plan by March 8, 2027 has its certification revoked. FedRAMP publishes migration resources at its VDR migration page and details in notice NTC-0017.

Frequently Asked Questions

What is the deadline to migrate from Rev5 to FedRAMP 20x VDR/VER?

Under NTC-0014, FedRAMP Certified services must migrate to VDR/VER by December 7, 2026. NTC-0017 (November 10, 2026) added progress reporting and a grace period through March 7, 2027. Services that plan to complete after February 3, 2027 are shown as "FedRAMP Certified (In Remediation)", and services with no approved Corrective Action Plan by March 8, 2027 face revocation.

How much of the FedRAMP 20x requirements does Casco cover with evidence?

Casco provides evidence for up to 42% of FedRAMP 20x controls. By class, that is 26 of 66 requirements for Class A, 87 of 203 for Class B, and 87 of 203 for Class C. The rest remains your responsibility: scope, PAIN ratings, fixes, reports, the Security Decision Record, and the independent assessment.

Does Casco replace our 3PAO or get us authorized?

No. Casco does not replace the independent assessor; its evidence supports the assessment. Certification also does not authorize use at any agency. Each agency makes its own authorization and purchasing decision, using the standardized, reusable security package that certification provides.

What does "evidence for" a requirement actually mean here?

It means Casco's testing output, such as reproduced exploits, retest results, internet-reachability evidence, and structured finding data, maps to named VDR/VER and KSI requirements so you can incorporate it into your FedRAMP reporting workflow. It does not mean Casco meets or automates the controls for you, and retest results show whether a previously demonstrated exploit still works within the tested scope, not a blanket claim of full remediation.

Conclusion

The Rev5 to 20x migration rewards teams whose security testing already produces continuous, reproducible, machine-readable evidence, and it penalizes those relying on an annual report and a binder. With the December 7, 2026 VDR/VER deadline and the March 7, 2027 grace period on the calendar, the practical question is whether your testing vendor's output maps to named FedRAMP requirements. Casco for Government is FedRAMP 20x Class A certified and provides evidence for up to 42% of FedRAMP 20x controls, with the coverage counts and requirement IDs published for your assessors to review. See the coverage details and book a FedRAMP demo to see how the evidence fits your migration plan.