Column H – Specify the implementation status of the control at the completion of testing Implementation Status [implemented/partially implemented/ planned/ alternative implementation/not applicable]. Column I – <date> Insert the date of the testing in the Column Header and specify the status of the Findings control at the completion of testing for each test [satisfied/other than satisfied]. Column J – Likelihood Specify the likelihood a threat will exploit the vulnerability identified [high/moderate/low]. Column K – Impact Specify the impact to the system if the threat successfully exploits the vulnerability [high/moderate/low]. Column L – Risk Specify the risk exposure to the system if the vulnerability associated with this control Exposure is exploited [high/moderate/low]. Column M – Risk Fully describe the details of the risks to this specific system if the vulnerability is Description exploited. Column N - Fully describe the recommendation for remediation of the risk associated with this Recommendation for control. Mitigation Column O – Assessor Specify the assessor name and contact information [e.g., email, phone] for each test. POC Column P – Divider This column separates the results of the current assessments from results and findings from previous assessments. Column Q – <Date> Insert the date of the previous assessment and specify the status of a prior finding Prior Findings associated with this control. [satisfied/other than satisfied]. Column R – <Date> Insert the date of the previous assessment and specify the risk exposure to the Prior Risk system if the vulnerability associated with this control is exploited. [High/Moderate/Low]. (POA&M) The CSP prepares and submits the Plan of Action and Milestones (POA&M) utilizing the FedRAMP Plan of Action and Milestone (POA&M) Template Completion Guide. The CSP documents all residual risks identified in the SAR and defines a plan for remediation of those risks in the template provided and provides an inventory list of the system tested. The CSP includes known risks identified by the 3PAO that are associated with leveraged systems in the POA&M.
Column H – Implementation Status Specify the implementation status of the control at the completion of testing [implemented/partially implemented/ planned/ alternative implementation/not applicable]. Column I – <date> Findings Insert the date of the testing in the Column Header and specify the status of the control at the completion of testing for each test [satisfied/other than satisfied]. Column J – Likelihood Specify the likelihood a threat will exploit the vulnerability identified [high/moderate/low]. Column K – Impact Specify the impact to the system if the threat successfully exploits the vulnerability [high/moderate/low]. Column L – Risk Exposure Specify the risk exposure to the system if the vulnerability associated with this control is exploited [high/moderate/low]. Column M – Risk Description Fully describe the details of the risks to this specific system if the vulnerability is exploited. Column N - Recommendation for Mitigation Fully describe the recommendation for remediation of the risk associated with this control. Column O – Assessor POC Specify the assessor name and contact information [e.g., email, phone] for each test. Column P – Divider This column separates the results of the current assessments from results and findings from previous assessments. Column Q – <Date> Prior Findings Insert the date of the previous assessment and specify the status of a prior finding associated with this control. [satisfied/other than satisfied]. Column R – <Date> Prior Risk Insert the date of the previous assessment and specify the risk exposure to the system if the vulnerability associated with this control is exploited. [High/Moderate/Low]. (POA&M) The CSP prepares and submits the Plan of Action and Milestones (POA&M) utilizing the FedRAMP Plan of Action and Milestone (POA&M) Template Completion Guide. The CSP documents all residual risks identified in the SAR and defines a plan for remediation of those risks in the template provided and provides an inventory list of the system tested. The CSP includes known risks identified by the 3PAO that are associated with leveraged systems in the POA&M.