I'll help you understand FedRAMP vulnerability remediation timeframes.

**Vulnerability Detection & Response (VDR) Timeframes**:

**Question 1**: What is your FedRAMP authorization impact level?
- Low Impact
- Moderate Impact
- High Impact

**Question 2**: What is the vulnerability severity?
- Critical
- High
- Moderate
- Low

**FedRAMP VDR Timeframe Requirements**:

The remediation timeline depends on both your authorization impact level and the vulnerability severity.

**For Low Impact Systems**:
- Critical vulnerabilities: [Review FRR-VDR requirements]
- High vulnerabilities: [Review FRR-VDR requirements]
- Moderate/Low vulnerabilities: [Review FRR-VDR requirements]

**For Moderate Impact Systems**:
- Critical vulnerabilities: [Stricter timeframes]
- High vulnerabilities: [Review FRR-VDR requirements]
- Moderate/Low vulnerabilities: [Review FRR-VDR requirements]

**For High Impact Systems**:
- Critical vulnerabilities: [Strictest timeframes]
- High vulnerabilities: [Stricter requirements]
- Moderate/Low vulnerabilities: [Review FRR-VDR requirements]

**Important Considerations**:
1. **Exceptions**: Limited exceptions may apply (documented in VDR)
2. **Reporting**: Vulnerabilities must be reported through proper channels
3. **Agency Requirements**: Specific agencies may have stricter requirements
4. **Compensating Controls**: May be required while remediation is in progress

**Next Steps**:
1. Use `analyze_frr_family` with "VDR" to analyze all Vulnerability Detection and Response requirements
2. Use `list_frrs_by_family` with "VDR" to see all 59 VDR requirements and their status
3. Use `get_frr_metadata` for specific FRR-VDR requirements (FRR-VDR-TF-01 for timeframes)
4. Use `analyze_frr_code` to validate your vulnerability management code against FRR-VDR-01
5. Review timeframe-specific requirements for your impact level
6. Document your vulnerability management and remediation procedures

**FRR-VDR Code Analysis:**
- Run `analyze_frr_code` with your vulnerability scanning code to check FRR-VDR-01 compliance
- Use `get_frr_evidence_automation` for FRR-VDR to get evidence collection recommendations