POA&Ms created, to document Rev. 5 control gaps, can be captured as Low severity "manual findings". Once the Rev. 5 control is fully implemented, a CSP should identify the evidence that supports POA&M closure in column Y "Supporting Documents" of the POA&M. For CSPs in the continuous monitoring phase, FedRAMP recognizes this may result in a spike of past due POA&Ms during the transition. Please work with your agency AO to determine the appropriate course of action.
Comments
0 comments
Please sign in to leave a comment.