Skip to content

Sources

This page was generated using Super Intelligence.

This website provides guidance and tools for the VDR/VER migration and progress reporting. Its pages are written in Markdown and rendered into HTML using Zensical. The underlying VDR/VER rules are maintained separately in FedRAMP/rules.

For AI agents and automation

Read the Markdown directly from the FedRAMP/vdr-migration repository when retrieving or analyzing this site's guidance. Use the content directory instead of scraping the rendered HTML. For rule analysis, use the structured rules in FedRAMP/rules.

Source files

Public Notice

Public Notice NTC-0017 VDR/VER Migration Progress Reporting and Upcoming FY27 Q1 FedRAMP Security Inbox Test explains the background behind this web site.

Migration Guidance

The VDR/VER migration repository contains the source pages, report formats, examples, and validator for this site.

For plain Markdown without the GitHub interface, use a file's Raw view. For example, read this Sources page as raw Markdown.

FedRAMP Rules

The FedRAMP/rules repository contains fedramp-consolidated-rules.json, the structured source for FedRAMP rules. Read its agent instructions when working with that data.

The FedRAMP/2026-markdown repository provides the broader Consolidated Rules website as Markdown. Use it for related rule documentation and explanatory guidance beyond this migration site.

Instructions for SI agents

  1. Start with the right source. Use this repository's Markdown for migration and collection guidance, the rules repository for rule requirements, and the downloadable schemas for the supported Mini-SDR format. Follow relative links in Markdown to read the relevant context.

  2. Check applicability and versions. Read the full rule, including its affected parties, framework, class, and any class-specific variants. Keep the report's schemaVersion separate from its rulesVersion. Identify the version or commit used in your analysis; do not assume a pinned report baseline is the latest upstream release.

  3. Keep examples separate from requirements. The example reports describe fictional providers and were created with an LLM agent using PERSONAS.md. Their practices, dates, and confidence estimates do not add requirements or establish approval. Preserve the FAQ's source-snapshot qualifications when using its answers.

  4. Cite sources and flag conflicts. Link conclusions to the relevant source page or rule. If sources differ, identify the conflicting statements rather than inventing a resolution. Use the Emergency Test notification for final submission instructions.

  5. Respect the limits of validation. A passing Mini-SDR validation result establishes format and consistency checks only. It does not assess the quality of an implementation or corrective action plan. The separate activity-report samples are outside the validator's scope.

Comments