Static, click-through screens for the POA&M Management Platform — no backend, no framework, no build step. Field names and workflow rules follow the FedRAMP POA&M template (SSP Appendix O v3) so the screens map cleanly onto the data model when these get rebuilt as React/Inertia pages.
KPI tiles, risk distribution, opened-vs-closed trend, remediation-window compliance, overdue table and activity feed.
Triage queue with source, severity and asset columns. Bulk-convert selected findings into POA&M items.
Scanner output, affected assets, mapped controls, attachments and the triage decision panel.
The main register. Open / Closed / Configuration Findings / Deviations tabs, filters, bulk actions, row menus.
The richest screen — overview, milestones, evidence, comments, history, plus every FedRAMP field in the side rail and a deviation-request modal.
Full create form grouped into template sections, with mandatory/situational markers and inline template guidance.
Kanban board across four workflow columns, plus a dated milestone schedule that rolls up to parent items.
Approval queue, file grid, upload panel, version history with rejection reasons, and retention policy.
Report library, programme analytics (ageing, closure time, backlog) and scheduled deliveries.
Five-step wizard: upload, choose worksheets, map columns, validate with per-row resolutions, then import.
Inbox with mention, assignment and due-date tabs, alongside a full per-event preference panel.
Append-only change history with actor, field-level before/after values and source IP.
Tenant profile, systems with impact level and health, submission calendar, isolation model and usage.
User table with MFA and expiry state, a full 6×20 RBAC permission matrix, pending invitations and an invite modal.
Statuses, closure rules, ID patterns, risk ratings with remediation windows, sources, frameworks, security and integrations.
Entra ID, Okta and SAML/OIDC single sign-on, email fallback, and a passkey path that satisfies MFA in one step.
Six-digit code entry with a rotation timer, trust-this-browser, and fallbacks to security key, passkey or recovery code.
Method chooser, QR pairing with a manual key, verification, single-use recovery codes and trusted-device management.
Dashboard, Findings, Tasks, Evidence and Reports as a handheld app: bottom tab navigation, card lists instead of tables, bottom sheets instead of modals, and camera-first evidence capture. Same tokens and risk palette as these web screens.
Four ordered ratings. The hue is always paired with a written label — colour never carries the meaning on its own, and the set was validated for colour-vision deficiency separation on a white surface.
Navigation, top bar and page header are rendered once by shell.js, so each screen file holds only its own content. To add a screen: copy any page, change the POAM.init() call, and add an entry to the NAV array in the shell.
Everything is static. Buttons, filters and forms are visual only — the exceptions are tabs, modals, chart tooltips, the table-view toggles, row checkboxes and the navigation layout switch, which all work so the flow can be demonstrated.