Start here — the core document
The Method
A Deterministic, CVSS-Environmental Method for FedRAMP VDR/VER Vulnerability Prioritization — closed-form PAIN derivation, the VDR-TFR-PVR remediation matrix, worked examples, a reference architecture, and an example archetype-to-profile catalog. The formula requires an independently dimensional asset security-impact profile, not that taxonomy. The companions below build on it.
Prefer a lighter read? Companion Blog
If You Think VDR Is About Security and Not Risk, You Are Missing the Point
Why vulnerability hygiene is not risk management, how rushed emergency hotfixes create operational self-harm, how to model multi-tenant blast radiuses, and why front-loading the derivation method replaces hundreds of un-auditable Deviation Requests with deterministic math.
Before the PAIN Equation
Deriving Security-Requirements Ceilings from Intended Federal Information Types — maps confirmed CSO and agency intended use through NIST SP 800-60 and FIPS 199, preserves the full C/I/A vector, and keeps the asset security-impact profile reusable across agencies. CSPs may derive that profile from an archetype, direct per-objective assessment, or another governed method. It also treats Certification Class as the provider's operational assurance commitment, defines the agency/CSP contract decision for High-objective use below Class D, and adds an Availability-specific assurance case connecting AR:H to uptime, RTO/RPO, disaster recovery, testing, and contract evidence without prescribing one architecture.
High-Centered PAIN Calibration
Calibrating PAIN Without Abandoning CVSS: High-Centered Normalization and Standards-Anchored Thresholds — corrects the Medium-centered normalization defect, derives the PAIN boundaries from stated scenarios, treats compound dimensional impact as a transparent vulnerability-breadth proxy without adding CWE as a severity input, documents governed provider variation, and exhaustively tests the 729-state lattice.
Compliance & Benchmark Findings
A Deterministic PAIN and Remediation Method for FedRAMP Compliance and Security-Benchmark Findings — extends the method above to STIG, CIS, and cloud-configuration findings: a severity×asset effect matrix, an internet-exercisability test for remediation timeframes, and governed classifier artifacts — validated by adversarial review and a back-test against a real CIS GCP scan.
PAIN & Remediation Playground
A friendly way to see how PAIN and remediation timelines work under our approach — no paper-reading required. Pick a CVE (or look one up live), answer five plain-English questions about the asset, exploitation, and exposure, and watch the N-level and deadline derive themselves, with FedRAMP's timeframe matrix and every step of the arithmetic one click away.
Companion methods
Internet Reachability at Scale
Internet Reachability at Scale under the FedRAMP VDR/VER Rules — recommends a current profile based on direct exposure, reusable CVE-level indirect-trigger promotion, and standing prevention assertions backed by existing assessment, DAST, and remediation evidence. This produces a conditional convergence toward direct accessibility plus known uncovered indirect triggers. Its separate content/transform equation is a non-normative interoperability reference, not a proposed current FedRAMP requirement.
Prefer a lighter read? Companion Blog
Payload Path Explorer
A hands-on way to see what makes a finding internet-reachable — no paper-reading required. Drop CVEs onto a small cloud architecture, flip real-world controls like protocol termination, identity-aware proxies, and parameterized queries, and watch the payload's path light up or get cut — including how a reachable RCE on one host can drag a co-resident local-only flaw into reach.
Further proposals
VLEV — Exploitability Gradation
A Finer Exploitability Gradation (VLEV) for FedRAMP VDR/VER — splits exploitability into three bands (NLEV / LEV / VLEV) aligned to CISA Vulnrichment, with the full six-column remediation grid per Certification Class.
VEX (CycloneDX) — Disposition
A CycloneDX VEX Profile for FedRAMP VDR/VER Disposition and Response — the machine-readable carrier for the post-detection disposition step (false positive, not reachable, mitigated, or accepted with an attested response), with a VER field mapping, an OCI distribution pattern, and an optional CISA-label crosswalk.
Build from source
These are informational documents. PDFs are rendered from the LaTeX sources:
brew install tectonic # one-time tectonic vdr-pain-cvss.tex # -> vdr-pain-cvss.pdf tectonic vdr-pain-security-requirements.tex # -> upstream derivation PDF tectonic vdr-pain-calibration.tex # -> vdr-pain-calibration.pdf tectonic vdr-pain-compliance.tex # -> vdr-pain-compliance.pdf tectonic vlev-proposal.tex # -> vlev-proposal.pdf tectonic vex-cyclonedx.tex # -> vex-cyclonedx.pdf tectonic internet-reachability.tex # -> internet-reachability.pdf tectonic internet-reachability-companion-blog.tex # -> plain-language PDF