Is a risk-acceptance request the same as approval?

No. A request remains pending until the authorized decision-maker acts. Rationale, approver and expiry need their own record.

Can a POA&M item be closed when a scanner no longer returns it?

Only after confirming the scanner actually covered the resource and the result supports closure. A failed or incomplete pull must not silently resolve it.

Does scm.cc export the official FedRAMP workbook?

Its current POA&M page exports CSV and the monthly package includes POA&M data. Do not treat that as the official FedRAMP Excel template without verifying formatting and acceptance separately.

Why do POA&M counts differ from control weakness counts?

The POA&M overview counts open and in-progress weaknesses once each; mapped control counts include other non-closed states and can count one weakness against multiple controls.

POA&M automation for FedRAMP: from scanner finding to corrective action

A Plan of Action and Milestones (POA&M) tracks known security weaknesses, the work planned to correct them, the responsible owner, and scheduled milestones. In FedRAMP continuous monitoring, it is a living record linked to assessment and scan findings, not a spreadsheet of already-closed tickets. Discovery dates and unresolved work must remain visible so an authorizing official can judge residual risk.

Product measurement: scm.cc's POA&M view separately counts open or in-progress weaknesses, overdue items and incomplete records. Its controls view counts all non-closed mapped weaknesses, including blocked and risk-accepted items; those two totals are intentionally not the same number.

FedRAMP now uses Certification and Classes A-D for package baselines. During the transition through December 31, 2026, Class B (Low), Class C (Moderate) and Class D (High) pair the new class with the earlier label; Class A is a pilot. Certification does not replace an agency's own authorization to operate. Historical Rev 5 baseline identifiers in records stay unchanged.

What belongs in a FedRAMP POA&M?

FedRAMP's template completion guide calls for traceable weaknesses from security assessments and continuous monitoring, their corrective actions, responsible owner and scheduled completion. The original detection date should stay tied to when the issue was first found, not when it was imported into a tool. Findings from scans and manual assessments need a unique identity; related weaknesses should not be blended until their separate risks disappear.

Source and unique weakness or vulnerability reference.
Original detection date, owner, planned completion and milestone history.
Current disposition, supporting evidence and any risk-deviation request and decision.

How do you avoid a false closure?

A sync can miss part of the estate because permissions fail or a provider stops paging. Closing every missing finding after that run would be a data-loss error, not remediation. Match a closure to new source evidence or a reviewed decision, preserve the earlier history, and reopen recurring vulnerabilities. A request for a deviation is not approval: the recorded rationale, decision-maker and expiry matter.

Keep failed or truncated pulls degraded and avoid treating their omissions as resolved findings.
Keep rejected or pending risk acceptance visible as open risk.
Review evidence behind a 'closed' state rather than relying on the label.

What does scm.cc provide today?

The signed-in POA&M page accepts manually recorded weaknesses and lets a user promote findings. Promotion associates the finding with a weakness in one transaction; it does not prove remediation. It shows ownership, target dates, incomplete fields, overdue counts and a history of status changes. A deviation workflow separates request from decision. CSV export is available. The monthly package includes POA&M data beside finding and evidence material; its output does not replace the official FedRAMP workbook or an assessor's review.

A free account can inspect its dashboard; Starter ($299 per month) lists POA&M tracking and CSV export.
Test a real recurring weakness and verify it returns when the source finds it again.

How does 20x change vulnerability reporting?

FedRAMP 20x's vulnerability rules use evaluated impact and exposure to set response timeframes and introduce machine-readable vulnerability reporting. scm.cc can record a PAIN evaluation and calculate deadlines when those fields exist; unevaluated findings stay labeled unevaluated. Its monthly package includes machine-readable report types, but schema shape validation is not independent approval, and the production three-day machine-validation cadence remains unfinished.

Do not assign an impact rating the source or owner has not evaluated.
Do not confuse a monthly POA&M cycle with 20x Class C's separate resource-validation frequency.

Questions teams ask

Is a risk-acceptance request the same as approval?: No. A request remains pending until the authorized decision-maker acts. Rationale, approver and expiry need their own record.
Can a POA&M item be closed when a scanner no longer returns it?: Only after confirming the scanner actually covered the resource and the result supports closure. A failed or incomplete pull must not silently resolve it.
Does scm.cc export the official FedRAMP workbook?: Its current POA&M page exports CSV and the monthly package includes POA&M data. Do not treat that as the official FedRAMP Excel template without verifying formatting and acceptance separately.
Why do POA&M counts differ from control weakness counts?: The POA&M overview counts open and in-progress weaknesses once each; mapped control counts include other non-closed states and can count one weakness against multiple controls.

Primary sources

Source and product behavior reviewed September 30, 2026. Check current FedRAMP rules before relying on a schedule or submission requirement. This is product guidance, not an assessment, legal advice, certification or authorization.