Likelihood Impact Low Moderate High High Low Moderate High Moderate Low Moderate Moderate Low Low Low Low Table 3-6 Risk Exposure Ratings – <3PAO and CSP names> reviewed all identified weaknesses and assigned a risk to the weakness based on table 3-6. All identified scan risks have been assigned the risk identified by the scanning tool. Documenting the results of security control testing creates a record of the security posture for the system at a given moment in time. The record can be reviewed for risk-based decision making and to create plans of action to mitigate risks. The Federal Information Security Management Act (FISMA) requires that a Plan of Action and Milestones (POA&M) (using the format guidance prescribed by OMB) be developed and utilized as the primary mechanism for tracking all system security weaknesses and issues. <CSP> will leverage the SAR to create a Plan of Action and Milestones (POA&M) for <Information System Name>. The POA&M is a mitigation plan designed to address specific residual security weaknesses and includes information on costing, resources, and target dates This section describes all security weaknesses found during testing. The following elements for each security weakness are reported. Identifier Name Source of Discovery Description Affected IP Address/Hostname/Database Applicable Threats Likelihood (before mitigating controls/factors) Impact (before mitigating controls/factors) Risk Exposure (before mitigating controls/factors) Risk Statement Mitigating Controls/Factors
Likelihood Impact Low Moderate High High Low Moderate High Moderate Low Moderate Moderate Low Low Low Low Table 3-6 – Risk Exposure Ratings <3PAO and CSP names> reviewed all identified weaknesses and assigned a risk to the weakness based on table 3-6. All identified scan risks have been assigned the risk identified by the scanning tool. Documenting the results of security control testing creates a record of the security posture for the system at a given moment in time. The record can be reviewed for risk-based decision making and to create plans of action to mitigate risks. The Federal Information Security Management Act (FISMA) requires that a Plan of Action and Milestones (POA&M) (using the format guidance prescribed by OMB) be developed and utilized as the primary mechanism for tracking all system security weaknesses and issues. <CSP> will leverage the SAR to create a Plan of Action and Milestones (POA&M) for <Information System Name>. The POA&M is a mitigation plan designed to address specific residual security weaknesses and includes information on costing, resources, and target dates This section describes all security weaknesses found during testing. The following elements for each security weakness are reported. Identifier Name Source of Discovery Description Affected IP Address/Hostname/Database Applicable Threats Likelihood (before mitigating controls/factors) Impact (before mitigating controls/factors) Risk Exposure (before mitigating controls/factors) Risk Statement Mitigating Controls/Factors
FedRAMP-Annual-SAR-Template.docx