Identification

POA&M ID *

Edit

Auto-assigned. Must stay unique and consistent across submissions.

Originating finding FND-0318 — Weak cipher suites on internal API gatewayCreate without linking a finding

Description, source and detection date are copied from the finding.

Weakness name *

A short description of the weakness. For scan findings, use the plugin/vulnerability title.

Weakness description * The internal API gateway negotiates TLS_RSA_WITH_AES_128_CBC_SHA and other CBC-mode cipher suites. These do not provide forward secrecy and are disallowed by the system's cryptographic baseline.

Full description of the weakness and any other relevant detail from the assessment.

NIST 800-53 controls *

SC-8 SC-13

Detection Source

Weakness detector source * Tenable NessusQualys VMDR3PAO Assessment Penetration TestInternal AuditCustomer Audit Manual Observation

Weakness source identifier

Plugin or vulnerability ID, where applicable.

CVE

Asset identifiers *

Must match the corresponding unique asset IDs in the Integrated Inventory Workbook.

Risk & Schedule

Original risk rating * LowModerateHigh

Adjusted risk rating —LowModerateHighN/A

Leave blank unless a risk adjustment was approved.

Status * DraftOpenIn ProgressPending ReviewDelayed

Original detection date *

Scheduled completion date *

Auto-calculated from the risk rating — moderate findings get 90 days.

Status date *

Remediation windowsHigh and critical: 30 days from discovery · Moderate: 90 days · Low: 180 days. Changing the risk rating recalculates the scheduled completion date.

Ownership & Remediation

Point of contact * Marcus Patel — Platform EngineeringRina Kaur — Platform EngineeringTomas Nguyen — SecurityDana Mitchell — ISSO

Resources required

Remediation plan *

Especially important where remediation extends beyond the standard window.

Vendor Dependency & Deviations

Vendor dependency * NoYes

Vendor product name

Last vendor check-in

Risk adjustment NoYesPending

False positive NoYesPending

Operational requirement NoYesPending

Deviation rationale

CISA BOD 22-01

Listed in the CISA KEV catalogue NoYes

BOD 22-01 due date

Additional Information

Comments

Supporting documents

Attach supporting documents

Scan output, screenshots, change records · up to 100 MB each

Break the remediation plan into dated milestones. You can also add them after the item is created.

Every risk identified in the SAR Risk Exposure Table needs a matching POA&M item. During continuous monitoring only past-due scan risks must be tracked, but all 3PAO assessment risks belong in the authorization package submission.

Open the field reference