POA&M Overview

Overview

Plans of Action and Milestones, also known as POA&Ms, are a standard US government or high compliance environment method for documenting remediation tasks related to risks in your environment. Simply, it is a document that “identifies tasks needing to be accomplished” (https://csrc.nist.gov/glossary/term/POAM) to include all the related data for external auditors to review a vulnerability management program.

Many government organizations rely on POA&Ms to manage their process for granting Authorities to Operate (ATOs). For more information on how POA&Ms are used, it may be useful to check out how the Center for Medicare and Medicaid Services (CMS) use POA&Ms to manage their ATOs: https://security.cms.gov/learn/plan-action-and-milestones-poam

Any FedRAMP organization or a product wanting to become FedRAMP-certified is required to leverage POA&Ms to track their risk remediation process and outcomes. The outcome is generally rolled up into a Continuous Monitoring (ConMon) report that is shared with Federal Auditors (partially seen below).

Supported Versions

Nucleus supports FedRAMP Revision 5 (v2.1) and FedRAMP 4 (v2.0) templates

Usage

Nucleus provides the ability inside to Nucleus to map and manage POA&Ms within the platform, tied directly to the vulnerability findings generated by your vulnerability scanning tools.

There are 27 distinct fields that must be generated on a continuous basis for every vulnerability in your environment, partially seen below from the standard FedRAMP POA&M template.

All of the fields are managed and required to be reported in either excel or OSCAL. Nucleus provides the capability within the platform to manage all of the required POA&M fields. An example can be seen on the “Vulnerabilities > Active > Vulnerability Details > Instances > POA&Ms” tab

Automated POA&M Workflows

There are some common POA&M actions that are required to manage, many of which can leverage the Automation Workflows in Nucleus. When you have the POA&M module enabled, you will see new actions available to you in the Automation engine, which include populating every single field in a POA&M

Example: Automatically create a POA&M when SLA is not met

One common example of how to leverage a Nucleus automation workflow to automate POA&M management is creating a POA&M when the patch date is passed. You are not required to create a POA&M for certain vulnerabilities until an SLA is not met. In Nucleus, you would configure the workflows in the following way to achieve this outcome:

1. Navigate to “Automation > Finding Processing” and select “+ Add Rule”.

2. In the match criteria, select the vulnerability severity on the findings where you want to apply these actions.

   1. In this example, let’s use Severity of Critical

3. Navigate to the “Actions” tab, and select “Set Due Date”

   1. Set a due date for 30 days from “now” or “discovered date”

4. Save the rule

   1. Optionally click “Run Now” to apply the rule we just created to all findings already in Nucleus. This rule will run every time new data is ingested into the platform.

5. This rule is now complete and is setting an SLA patch date for all Critical Severity findings.

6. Create another rule. This rule will apply on findings which are overdue on their due dates and create POA&Ms.

   1. Click “+ Add Rule”

7. In the match criteria, use the “Due Date" = “Overdue”. This will select findings that are overdue on their SLA.

8. Navigate to the Actions tab, and select a POA&M action, such as “Add remediation plan”.

   1. Note: You can select multiple actions in one rule

9. Select Save

You have now configured Nucleus to automatically set the due date for vulnerabilities, and then to also create POA&Ms automatically when a due date passes on a particular finding. This is one example of many where you can automatically assist with populating POA&Ms using Nucleus automation.

Filter by POA&Ms

In order to see which findings in Nucleus have POA&Ms already, you have the ability to search for all findings where POA&Ms exist, or you can search by the POA&M ID (including your Display ID). To do this,:

1. Navigate to “Vulnerabilities > Active” and select the “Filter” button in the table header.

2. Use the “POA&M” filter

You can search for any findings where the POA&M exists or you can search for specific POA&Ms using the “is one of” filter option and pasting in a POA&M ID.

Appendix - List of Field Mappings