Is it required that each individual Rev. 5 control be tracked as a unique plan of action and milestone (POA&M), or is a high level transition finding acceptable?

Related articles

• CA-7 has a new "Additional FedRAMP Requirement" to perform monthly Service Configuration Scans. Does this require all CM-6 benchmark scans to be performed and uploaded monthly?
• Vulnerability Scanning
• FedRAMP Authorization Process
• How can CSPs ensure vendors build and test in alignment with NIST 800-171 or equivalent framework as required by SR-6 in the High and Moderate baselines?
• What is the difference between Federal Information Security Modernization Act (FISMA) and FedRAMP controls?