Documenting a CSP’s Rev. 4 vs Rev. 5 delta as plan of action and milestones (POA&Ms) may cause a large spike in a CSPs POA&M count if they carry those POA&Ms from September 1st 2023 until the CSP’s next annual assessment.

POA&Ms created to document Rev. 5 control gaps can be captured as Low severity "manual findings." Once the Rev. 5 control is fully implemented, a CSP should identify the evidence that supports POA&M closure in column Y, "Supporting Documents," of the POA&M. For CSPs in the continuous monitoring phase, FedRAMP recognizes this may result in a spike of past due POA&Ms during the transition. Please work with your agency AO to determine the appropriate course of action.