Spreadsheet: 2dda70d8-ad1c-44ec-b8e6-2aca1484dd37
Sheet: FYXX System POA&M

FedRAMP Plan of Action and Milestones (POA&M) Template |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | Current Authorization to Operate (ATO) |  | No Contingency Plan
 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | Not Authorized to Operate |  | Completed Contingency Plan
FIPS 199 Risk Impact Level |  | Enter either Low, [NAME], or High |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | High |  | Completed Contingency Plan Test for FY 2012
FY 20XX System POA&M
<CSP> <Information System Name> |  |  |  | FY XXXX Exhibit 53 Project ID: NA – not a Federal system; not included in the Exhibit 53
ID | Type of Weaknesses | Platform | Point of Contact (POC) | Scheduled Completion Date | Scheduled Completion Date Changes | Milestones (e.g. remediation actions) with [NAME] | Milestone Changes | Source of Discovery | Status | Original Risk Rating | Adjusted Risk Rating | Rationale | Comments
Assign Unique identifier to each POAM item | Provide detailed weakness information | List the IP Platform(s) the weakness was found on or other applicable information | Person responsible for implementing this task | This is permanent and should not be changed.  Rescheduled completion dates should be entered in column G (milestone changes). | Provide proposed updated Schedule Completion Date as noted in the POA&M Extension Request | This is permanent and should not be changed.  Recommendation/Fix to correct the weaknesses | List any changes to existing milestones in Column G | This information should be consistent with information in the SAR | Ongoing or Completed with completion date. | Provide the Original Risk Rating of the weakness | Provide the Adjusted Risk Rating as approved by FedRAMP | Provide the Rationale for the adjusted risk rating | Provide additional comments as may be required
1 | Example 1 - Not all Access Control procedures listed in the SSP show evidence of having been reviewed or updated within the last two years. (AC-1)  -MODERATE RISK |  | [NAME] Vendor X | XX/XX/XXXX |  | XX/XX/XXXX:  CSP Vendor will document the review that was performed of the vendor Access Control policies and procedures (Access Control SOP).   XX/XX/XXXX:  CSP vendor will design a  process to facilitate review of access control policies and procedures at least annually;  update content when necessary; and revise the last reviewed date on each document. |  | Security Assessment / Risk Assessment XX/XX/XXXX | Completed:  XX/XX/XXXX | H | M | Describe mitigating factors/strategies here
1 | Example 2 -CSP vendor has not documented its implemented approach to basic security awareness training consistent with NIST SP 800-50. (AT-2) - MODERATE RISK |  | [NAME] | XX/XX/XXXX |  | XX/XX/XXXX:  CSP vendor is in the process of developing an annual security awareness program and documenting policy and procedures to govern this process.  The security awareness training will be mandatory for new and existing employees. The training requirement will be incorporated in the current required training curriculum monitored by the CSP vendors [NAME]. |  | Security Assessment / Risk Assessment XX/XX/XXXX  XQXX Quarterly Scans | Ongoing | M | L | Describe mitigating factors/strategies here
 | Example 3 - While CSP Vendor provides extensive access to security awareness information, the curriculum and training materials are not documented consistent with the required framework prescribed by NIST SP 800-50. (AT-3) -MODERATE RISK |  | [NAME] Vendor X | XX/XX/XXXX |  | XX/XX/XXXX:CSP vendor is in the process of developing an annual security awareness program and documenting policy and procedures to govern this process.  The security awareness training will be mandatory for new and existing employees and conform to the guidelines in NIST SP-800-50 |  | Security Assessment / Risk Assessment XX/XX/XXXX  XQXX Quarterly Scans | Ongoing
 | Example 4 - SNMP System Description Available (system.sysDescr) (Web Application Scanning (Web Inspect))  The SNMP System Description  is remotely available. This can give detailed operating system, build, and version information about the target. - MODERATE RISK |  | [NAME] | XX/XX/XXXX |  | XX/XX/XXXX:  CSP vendor will disable SNMP. IF required, vendor will ensure UDP 161 is blocked at the firewall or router and implement a difficult to guess community strings. Vendor will use SNMP v3 for greater security. |  | Security Assessment / Risk Assessment 09/15/2011, Finding #4  (CM-7, [NAME])) | Ongoing
 | Example 5  - Web Server HTTP TRACE Method Supported (Operating System Scanning ([NAME]))  The TRACE method is an HTTP command used for debugging purposes. A client sending the TRACE command to a web server will receive an echo of the entire request, including HTTP headers. It is possible for a malicious user to obtain sensitive information from the headers, such as cookies or authentication data. - MODERATE RISK |  | [NAME] Vendor X | XX/XX/XXXX |  | XX/XX/XXXX:  CSP vendor will disable the TRACE method. |  | Security Assessment / Risk Assessment XX/XX/XXXX  XQXX Quarterly Scans | Ongoing
 | Example 6 - SSL Server Weak Encryption and Communication Vulnerability (Operating System Scanning ([NAME])) - MODERTE RISK |  | [NAME] Vendor X | XX/XX/XXXX |  | XX/XX/XXXX:  SSL 2.0 protocol will be disabled. |  | XQXX Quarterly Scans  XQXX Quarterly Scans | Ongoing
 | Example 7 - OpenSSH Attack Vulnerability (Web Application Scanning (Web Inspect)) - HIGH RISK |  | [NAME] | XX/XX/XXXX |  | XX/XX/XXXX:  Update the  latest Operating System version. |  | XQXX Quarterly Scans | Completed:  9/30/2011