Settings · POA&M Tracker

POA&M Statuses

The workflow states an item can occupy. Reordering changes how the pipeline chart is drawn.

	Status	Colour	Type
⠿	Draft	Grey	Initial
⠿	Open	Blue	Active
⠿	In Progress	Violet	Active
⠿	Pending Review	Amber	Approval gate
⠿	Delayed	Orange	Active
⠿	Closed	Green	Terminal

Closure Rules

Require all milestones complete before an item can move to Pending Review

Require at least one approved evidence artefact before closureMatches the FedRAMP rule that evidence of remediation must be collected and available for inspection

Only ISSO and Organization Admin roles may close an item

Require a second approver for critical and high risk closures

Keep approved risk adjustments and operational requirements on the open worksheet

Identifier Format

POA&M ID pattern

Next will be POAM-0192. Tokens: {seq}, {year}, {system}, {control}.

Finding ID pattern

Next will be FND-0319.

Default windows follow FedRAMP guidance: high and critical within 30 days of discovery, moderate within 90 days, low within 180 days. Shortening a window is allowed; lengthening one is not.

Risk Ratings & Remediation Windows

Risk rating	Remediation window	Reminder schedule	Escalate to
Critical	days	30 / 14 / 7 / 1 day	ISSO + Org Admin
High	days	30 / 14 / 7 / 1 day	ISSO
Moderate	days	30 / 14 / 7 day	Item owner
Low	days	30 / 7 day	Item owner

Deviation Handling

Require a written rationale for every deviation request

Require supporting documents before a request can be submitted

Record the AO decision and decision date on the item

Auto-close items on approved false positiveOff by default — a human should confirm the closure

Finding Sources

The platform is framework-agnostic. Anything that produces a finding can feed the same POA&M workflow.

Vulnerability Scan61 findings

3PAO Assessment34 findings

Penetration Test19 findings

Internal Audit17 findings

Customer Audit5 findings

Manual Observation12 findings

Control Frameworks

Framework	Version	Controls	Used by	Status
NIST SP 800-53	Rev 5	1,189	3 systems	Enabled
FedRAMP Moderate Baseline	Rev 5	323	2 systems	Enabled
NIST SP 800-171	Rev 3	97	Not in use	Available
CIS Benchmarks	v8	153	1 system	Enabled

Control mapping is optional. Findings can be tracked without one, which is what keeps the platform framework-agnostic.

Authentication

Require MFA for all users

Single sign-on (Azure AD / SAML / OIDC)

Block password sign-in when SSO is available

Allow external auditor accounts

Session idle timeout

Maximum session length

External account expiry default

Data Protection

Encryption in transitTLS 1.3

Encryption at restAES-256

Key managementCustomer-managed keys

Evidence retention3 years after closure

Audit log retention7 years, append-only

BackupsNightly, off-site, 35-day PITR

IP Access Control

Allowed CIDR ranges

Leave blank to allow access from anywhere. External auditor accounts bypass this list.

Phase 1 supports file-based ingest only. Direct scanner, Microsoft 365 and cloud-provider connectors are planned for Phase 3.

FedRAMP Workbook

Import and export the POA&M template, with column mapping profiles and dry-run validation.

Available now

Scanner CSV Ingest

Upload Nessus, Qualys or generic CSV exports. Findings are de-duplicated against existing records.

Available now

SMTP / Email Delivery

Route notification and scheduled-report email through your own mail relay.

Not configured

Webhooks

Post status changes, closures and overdue events to an external endpoint.

Phase 3

REST API

Programmatic access to findings, POA&M items, milestones and evidence.

Phase 3

Assessment Engine

NIST 800-171 and CMMC questionnaires that generate findings automatically.

Phase 2