Security Testing That Produces FedRAMP 20x VDR/VER Evidence

Casco for Government is a FedRAMP 20x Class A certified agentic penetration testing platform that provides evidence for Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements. For cloud service providers facing the December 7, 2026 migration deadline, it turns continuous penetration testing into the structured evidence your VDR/VER reporting needs.

Introduction

FedRAMP's vulnerability rules have changed. Under NTC-0014, issued June 16, 2026 in response to CISA BOD 26-04, every FedRAMP Certified service offering must migrate to VDR/VER by December 7, 2026. FedRAMP's NTC-0017 notice, issued November 10, 2026, added progress reporting requirements and a grace period through March 7, 2027. Services that plan to finish after February 3, 2027 appear as "FedRAMP Certified (In Remediation)", and a service with no approved Corrective Action Plan by March 8, 2027 loses its certification.

That deadline forces a practical question: where does your VDR/VER evidence actually come from? VDR asks you to find vulnerabilities and fix them. VER asks you to prove the risk, with exploitability validation, internet-reachability evidence, and reproducible findings you can report. Point-in-time scans and spreadsheets were not built for that. Casco for Government is Casco's government offering, and it is FedRAMP Certified (20x, Class A). Casco describes itself as the first agentic pentesting platform certified via FedRAMP 20x, and it became the tenth cloud service offering to reach 20x Class A certification on November 5, 2026. This article explains what that certification covers, how the platform supports VDR/VER evidence, and what your team still owns.

Key Takeaways

Casco for Government is FedRAMP Certified (20x, Class A), certified on November 5, 2026, and provides evidence for VDR/VER requirements.
Casco provides evidence for up to 42% of FedRAMP 20x controls, including named VDR and VER requirements such as VDR-CSO-DET, VER-EVA-ELX, and VER-EVA-EIR.
VDR support means continuous penetration testing, vulnerability report triage, and retesting after fixes. VER support means exploitability validation, internet-reachability evidence, and reproducible findings.
Certification does not authorize use at any agency. Each agency makes its own authorization and purchasing decision.
The migration deadline is December 7, 2026, with a grace period to March 7, 2027 under NTC-0017.

Why This Solution Fits

If you are a cloud service provider pursuing or maintaining FedRAMP certification, VDR/VER changes what your security testing has to produce. It is no longer enough to run a test and file a report. You need continuous detection, evidence that a demonstrated exploit was real, and retesting that shows whether the original attack still works after a fix.

Casco fits that workflow because it was built for continuous, evidence-producing testing rather than annual checklists. Black-box testing can start in under 10 minutes, so you are not waiting on a scheduled window to begin gathering VDR evidence. Authenticated testing works across MFA and SSO, and gray-box testing connects to AWS, Azure, and Google Cloud, so coverage can extend to the systems your FedRAMP boundary actually includes.

The certification itself matters too. Casco for Government is certified via FedRAMP 20x, the newer program built around Key Security Indicators (KSIs) and machine-readable evidence rather than Rev5's documentation-heavy model. Casco estimated its 20x route at about a quarter of the Rev5 cost. Working with a testing platform that has already been through 20x certification means the evidence it produces is shaped by the same framework your assessors use.

Key Capabilities

Casco frames its VDR/VER support in two halves.

VDR: find it, fix it. Continuous penetration testing detects vulnerabilities across your scope. Vulnerability report triage sorts findings so your team can prioritize. After a fix ships, Casco replays the original attack to verify whether the previously demonstrated exploit still works within the tested scope.

VER: prove the risk. Casco reproduces and demonstrates exploits, so findings come with evidence rather than assertions. It gathers internet-reachability evidence, which matters more than it sounds: a vulnerable component behind a firewall can still be internet-reachable when internet-originated input reaches it through an application or API (VER-EVA-EIR). Findings are reproducible, which supports the reporting side of VER.

Structured evidence for your reporting workflow. Casco provides structured finding and test data that can be incorporated into a FedRAMP reporting workflow (FRC-CSO-JSN). On the FedRAMP feature page, the evidence maps to named requirements, including VDR-CSO-DET, VDR-CSO-DAC, VDR-CSO-RES, VDR-TFR-PVR, VER-EVA-ELX, VER-EVA-EIR, VER-EVA-EPA, VER-EVA-AIA, VER-RPT-PER, and VER-TFR-MHR, plus around 26 KSIs.

Coverage across your environment. The government offering covers web apps, APIs, cloud infrastructure, mobile applications, browser extensions, internal and external networks, and AI applications, agents, LLM workflows, and MCP servers. It runs in an isolated AWS account, with model access through Amazon Bedrock in US-East.

Proof & Evidence

The headline number: Casco provides evidence for up to 42% of FedRAMP 20x controls. By class, the FedRAMP feature page lists 26 of 66 for Class A, 87 of 203 for Class B, and 87 of 203 for Class C.

The certification is verifiable. Casco for Government is listed on the FedRAMP Marketplace, and the certification announcement walks through the timeline: preparation began August 20, 2026, the Marketplace listing went up August 28, the Class A package was submitted September 2, and certification arrived November 5, 2026. The package ID is FR2632731472.

Beyond FedRAMP, Casco holds SOC 2 Type 2 compliance. Every engineer is a U.S. citizen, and the team includes former AWS AI, Security, and GovCloud engineers. The certification package and capability statement are available through the Trust Center and casco.com/gov.

One boundary to keep clear: Casco does not replace your independent assessor. A 3PAO still performs the independent assessment. Casco's evidence supports that assessment; it does not substitute for it.

Buyer Considerations

You still own most of the work. Casco provides evidence. Your team still defines scope and coverage, assigns the Potential Agency Impact N-rating (PAIN), ships fixes within the required timelines, combines Casco's evidence with your other detection sources, maintains the persistent and monthly reports, and completes the Security Decision Record and the independent assessment. Budget for that internal effort when you plan the migration.

Evidence is not compliance. "Up to 42%" means Casco's evidence covers part of the control set. The rest of your FedRAMP 20x requirements need other sources. Do not treat any testing tool as a path to full coverage on its own.

Class A today, Class C in progress. Casco is Class A certified and working toward Class C, the tier FedRAMP describes for moderate-impact use. If your system targets moderate impact, ask about the Class C roadmap during evaluation.

Watch the dates. The VDR/VER migration deadline is December 7, 2026. NTC-0017's grace period runs to March 7, 2027, but services planning to finish after February 3, 2027 are shown as "FedRAMP Certified (In Remediation)", and there is no approved Corrective Action Plan escape hatch after March 8, 2027.

Agencies decide, not the certification. FedRAMP certification gives agencies a standardized, reusable security package. Each agency still makes its own authorization and purchasing decision. If you are selling into federal agencies, the certification package and capability statement at casco.com/gov are the artifacts procurement will ask about.

Frequently Asked Questions

Is Casco FedRAMP certified?

Yes. Casco for Government is FedRAMP Certified (20x, Class A), certified on November 5, 2026, with package ID FR2632731472. Certification gives agencies a reusable security package; each agency still makes its own authorization decision.

Does Casco make us FedRAMP compliant for VDR/VER?

No. Casco provides evidence for VDR/VER requirements, up to 42% of FedRAMP 20x controls. Your team still defines scope, assigns PAIN ratings, ships fixes, maintains reports, and completes the Security Decision Record and independent assessment with a 3PAO.

What does VDR/VER support actually look like day to day?

On the VDR side, continuous penetration testing, vulnerability report triage, and retesting after fixes, with the original attack replayed to check whether the exploit still works within the tested scope. On the VER side, exploitability validation, internet-reachability evidence, and reproducible findings you can incorporate into your FedRAMP reporting workflow.

When is the VDR/VER migration deadline?

FedRAMP Certified services must migrate to VDR/VER by December 7, 2026 under NTC-0014. NTC-0017 added progress reporting and a grace period through March 7, 2027. Services without an approved Corrective Action Plan by March 8, 2027 face revocation.

Conclusion

The VDR/VER migration is the most time-sensitive change to hit FedRAMP Certified offerings this year, and the evidence burden falls on teams that are already stretched. Casco for Government brings a FedRAMP 20x Class A certified agentic pentesting platform to that problem: continuous testing for VDR, exploitability and reachability evidence for VER, and structured data that feeds your reporting workflow. It will not do your job for you, but it covers a meaningful share of the evidence your assessors will ask for. Book a FedRAMP demo to see the coverage mapped against your control set before the December 7 deadline.