poam-automation-expert git:20260426.84d84d3A

Immutable. This exact content never changes and is served at /api/v1/blob/ef69fe058a6c0e46.

---
name: poam-automation-expert
description: "Expertise in FedRAMP POA&M lifecycle management, FedRAMP 20x VDR generation, and vulnerability classification using CISA KEV, EPSS, N-ratings, LEV/IRV, and NIST 800-53 control mappings."
---

# POA&M Automation Expert

## Tool Behavior

This connector wraps the FedRAMP POA&M Automation Tool — a Python CLI that manages the full vulnerability finding lifecycle from scanner import through FedRAMP 20x VDR generation.

### What it does

- Parses raw scanner exports (Nessus, Tenable, Qualys, Wiz) into a structured FedRAMP POA&M
- Auto-deduplicates findings across scanner imports using title + asset identifier
- Enriches findings with NIST 800-53 control mappings via keyword matching
- Manages finding lifecycle: update, close, deviation (false positive / operational requirement)
- Generates FedRAMP 20x VDR reports with live CISA KEV and EPSS enrichment
- Generates per-release Product VDR reports for customer-facing vulnerability disclosure
- Outputs machine-readable JSON alongside every Excel report

### VDR Classification Logic

Each finding is classified using live threat intelligence:

- **CISA KEV**: Finding CVE is checked against the live CISA Known Exploited Vulnerabilities catalog. KEV findings are bumped to minimum N3 adverse impact.
- **EPSS**: Exploit Prediction Scoring System score fetched from First.org API. Score ≥ 0.10 triggers LEV classification.
- **LEV/NLEV**: Likely Exploitable / Not Likely Exploitable. Determined by KEV membership, EPSS score, and severity fallback.
- **IRV/NIRV**: Internet Reachable / Not Internet Reachable. Derived from keywords in asset identifier and weakness description.
- **N-Rating**: N1 (lowest) to N5 (highest) adverse impact. Base rating derived from severity, then adjusted upward for KEV and IRV+LEV combinations.

### Evaluation Deadlines

Per FedRAMP 20x baseline:
- High: 2 days from detection
- Moderate: 5 days from detection
- Low: 7 days from detection

### Auto-Acceptance Threshold

Findings open 192+ days are automatically moved to the Accepted Vulnerabilities sheet per VDR-TFR-MAV.

### Update Frequency Requirements

- High baseline: Weekly (every 7 days)
- Moderate baseline: Every 14 days
- Low baseline: Monthly (every 30 days)

## Control Coverage

This connector maps findings to NIST 800-53 Rev 5 controls via keyword matching across 30+ control families including SI-2, RA-5, AC-2, AC-3, SC-8, SC-28, AU-2, CM-6, CM-7, and others.

## Failure Modes

- **Missing openpyxl**: Install with `pip install openpyxl`
- **CISA KEV unavailable**: Offline fallback uses severity-based LEV classification
- **EPSS unavailable**: Offline fallback uses severity-based LEV classification
- **POA&M file open in Excel**: Close the file before running any write command
- **Duplicate findings**: Automatically skipped on import — same title + asset identifier

## Limitations

- Product VDR requires a manually maintained vulnerability CSV — it does not auto-discover product vulnerabilities
- NIST control mapping is keyword-based, not authoritative — review mappings before submission
- AI remediation text requires Ollama running locally with the Mistral model