<#> <#> Total Table F-2 Final Summary of System Security Risks – Table F-3, Open POA&Ms, shows the number of POA&Ms with Ongoing status as of <date>. The third column shows POA&Ms identified as closed in the <date> POA&M that not had been validated by the AO or by <3PAO>. The Duplicate Open POA&M Entries column shows POA&M items where the same vulnerability, typically from scanning was open under different vulnerability IDs and can be consolidated. Adding the POA&Ms with ongoing status column to the POA&Ms closed but not validated and subtracting the duplicate open POA&Msresults in the numbers in the Open POA&Ms column (as of <date>. POA&Ms with POA&Ms Closed (as of Duplicate Open POA&M Open POA&Ms Severity Ongoing Status as <date>) but not Validated Entries (as of <date>) of <date> by AO or 3PAO High Moderate Low Total Table F-3 Open POA&Ms – Table F-4, Summary of Existing POA&Ms, shows the number of Open POA&Ms as of <date> from Table F-3. Some of these POA&Ms can be closed as a result of testing performed by <3PAO> during this annual assessment The number of open POA&Ms minus the number of POA&Ms closed through testing results in the total number of remaining POA&Ms that need to be carried
Total <#> <#> Table F-2 – Final Summary of System Security Risks Table F-3, Open POA&Ms, shows the number of POA&Ms with Ongoing status as of <date>. The third column shows POA&Ms identified as closed in the <date> POA&M that not had been validated by the AO or by <3PAO>. The Duplicate Open POA&M Entries column shows POA&M items where the same vulnerability, typically from scanning was open under different vulnerability IDs and can be consolidated. Adding the POA&Ms with ongoing status column to the POA&Ms closed but not validated and subtracting the duplicate open POA&Msresults in the numbers in the Open POA&Ms column (as of <date>. Severity POA&Ms with Ongoing Status as of <date> POA&Ms Closed (as of <date>) but not Validated by AO or 3PAO Duplicate Open POA&M Entries Open POA&Ms (as of <date>) High Moderate Low Total Table F-3 – Open POA&Ms Table F-4, Summary of Existing POA&Ms, shows the number of Open POA&Ms as of <date> from Table F-3. Some of these POA&Ms can be closed as a result of testing performed by <3PAO> during this annual assessment The number of open POA&Ms minus the number of POA&Ms closed through testing results in the total number of remaining POA&Ms that need to be carried
FedRAMP-Annual-SAR-Template.docx