POA&M Automation Expert

POA&M Automation Expert

Tool Behavior

This connector wraps the FedRAMP POA&M Automation Tool — a Python CLI that manages the full vulnerability finding lifecycle from scanner import through FedRAMP 20x VDR generation.

What it does

• Parses raw scanner exports (Nessus, Tenable, Qualys, Wiz) into a structured FedRAMP POA&M
• Auto-deduplicates findings across scanner imports using title + asset identifier
• Enriches findings with NIST 800-53 control mappings via keyword matching
• Manages finding lifecycle: update, close, deviation (false positive / operational requirement)
• Generates FedRAMP 20x VDR reports with live CISA KEV and EPSS enrichment
• Generates per-release Product VDR reports for customer-facing vulnerability disclosure
• Outputs machine-readable JSON alongside every Excel report

VDR Classification Logic

Each finding is classified using live threat intelligence:

• CISA KEV: Finding CVE is checked against the live CISA Known Exploited Vulnerabilities catalog. KEV findings are bumped to minimum N3 adverse impact.
• EPSS: Exploit Prediction Scoring System score fetched from First.org API. Score ≥ 0.10 triggers LEV classification.
• LEV/NLEV: Likely Exploitable / Not Likely Exploitable. Determined by KEV membership, EPSS score, and severity fallback.
• IRV/NIRV: Internet Reachable / Not Internet Reachable. Derived from keywords in asset identifier and weakness description.
• N-Rating: N1 (lowest) to N5 (highest) adverse impact. Base rating derived from severity, then adjusted upward for KEV and IRV+LEV combinations.

Evaluation Deadlines

Per FedRAMP 20x baseline:

• High: 2 days from detection
• Moderate: 5 days from detection
• Low: 7 days from detection

Auto-Acceptance Threshold

Findings open 192+ days are automatically moved to the Accepted Vulnerabilities sheet per VDR-TFR-MAV.

Update Frequency Requirements

• High baseline: Weekly (every 7 days)