FedRAMP Rev 5 P.8: P.8 Plan of action and milestones

Under control CA-5 the provider develops and maintains a POA&M on the FedRAMP template per the completion guide, submitted with the initial package and reviewed by the AO before authorization: every risk in the risk exposure table has a POA&M item, with unauthorized external services tracked as separate items even if combined in the table; all open risks sit on the open tab; risks remediated after the SAR go on the closed tab for validation at the annual assessment; risk adjustments reduce the scanner-defined level on documented mitigating factors and false positives are closed once validated, with 3PAO-validated ones marked yes and unvalidated ones marked pending and requiring AO approval before authorization; operational requirements are findings that cannot be remediated, never approved for High vulnerabilities, kept as open risks and reassessed periodically; vendor dependencies need no approval but High ones must be mitigated to Moderate within thirty days through compensating controls and the provider checks with the vendor at least monthly, recording the check-in date and product. Critical and High risks are remediated within 30 days of discovery, Moderate within 90 and Low within 180.