What is the process for handling false positives found during an initial or annual assessment when the security assessment report (SAR) is closed but has not yet been approved by the partnering agency?

All of the false positives, found during the annual assessment, should be added to the plan of action and milestones (POA&M). If they are approved before the SAR is closed/signed, they are moved to the “Closed POA&M Items” tab. If they have not been approved, they should remain in the “Open POA&M Items” tab until approved. Then, at least annually during assessment, the false positives should be evaluated for continued false positive status. For more information on handling the annual assessment and scan findings review the FedRAMP Continuous Monitoring Strategy Guide [PDF - 1.11MB].