Fedramp Poam Template

Csps should complete the system inventory worksheet first because the asset identifier in the poam worksheet refers to the inventory items.

Fedramp poam template. The current system poam worksheet the closed mitigated poam worksheet and an up to date system inventory worksheet. The complete security controls listed with the it portion and the ot supplemental guidance added. Poam template completion guide the poam document is a key document in the security authorization package. The fedramp program management office pmo mission is to promote the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment.

It describes the specific tasks the csp has planned to correct any weaknesses or deficiencies in the security controls noted during the assessment and to address the residual vulnerabilities in the information system. Use the modified fedramp templates gsa and dod provided poam template. The fedramp poam template provides the required information presentation format for preparing and maintaining a poam for the system. Fedramp uses the poam to monitor the csps progress in correcting these findings.

The fedramp poam template provides a structured framework for aggregating system vulnerabilities and deficiencies through security assessment and continuous monitoring efforts. Nist sp 800 82 ics overlay security controls. Fedramp facilitates the shift from insecure tethered tedious it to secure mobile nimble and quick it. The fedramp poam template completion guide provides explicit guidance on how to complete the poam template and provides guidance to ensure that the csp is meeting poam requirements.

The poam template is an excel workbook containing three worksheets. Nist sp 800 53 r4 and 800 82 r2 merged example. A csp applying for a fedramp jab p ato or a fedramp agency ato must establish and maintain a poam for their system in accordance with the poam template completion guide using the fedramp poam template. However csps are not permitted to alter or delete.

The poam includes the. The csp may add to the format as necessary to comply with its internal policies and fedramp requirements. Fedramp pmo created date. Poam template user guide v10february 18 2015.