When are Plan of Action and Milestones POAMs done in the RMF process

Sign up for free courses!
convocourses.com
convocourses.net - (Discounts and free stuff)
Join advanced readers group:
booksprout.co/...
Join the Newsletter:
convocourses.a...
Check us out here:
convocourses.org
/ convocourses
/ convocourses-108091850...
/ convocourses
Podcasts:
convocourses.p...
podcasts.apple...
Books on Amazon:
amazon.com/auth...
#convocourses
#cybersecurity
#isso
#nistrmf
#rmf
#usajobs#itjobs

[@ConvoCourses]

Check out free courses @ convocourses.com

[@uche2564]

JUst want to say man your page has been a big help, greatly appreciated

[@ConvoCourses]

thank you so much :) Glad to hear it!

[@dennywood3469]

Class act. Thank you for offering to help our veterans!

[@ConvoCourses]

Our pleasure!

[@Youcanthandlethetruth99]

Where would the security control assessor find the recommended remediation fix for failed controls to support the POAM without running a scan?

[@ConvoCourses]

SCA can find the remediation fixes or "expected results" in several places:
- Vulnerability scan results usually have the solutions to the finding (nessus calls in plugin Output or solution)
- For operational issues, the expected result is what the organization states in the policy (frequency of scan, backups schedule, audit log reviews)
- For policy and procedures, every industry has a certain standard and requirement of documents. 1 example is governments FISMA states that all organization should have a security policy and they should address every control.
A great resource for expected results is NIST 800-53A

[@Teesamp86]

If there are immediate fix to findings do you still have to create a POAM?

[@OshunBabyKhalimaCrazy]

Where can i find that control list?

[@TooLazyToFail]

Little late I know, but what you're looking for is NIST SP 800-53.

[@medianetwork7972]

☝️👍

[@marandamarkwood6639]

Huh